AUE_AUDITON_SPOLICY

Chargement d’une règle d’audit

Cet évènement est généré lorsqu’un système d’audit charge avec succès une nouvelle règle d’audit.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_AUDITON_SPOLICY Example

Exemple de journal de télémétrie pour le chargement d’une règle d’audit.

{
  "arguments": {
    "cmd": 34,
    "policy": 13,
    "length": 4
  },
  "header": {
    "time_seconds_epoch": 1657732936,
    "time_milliseconds_offset": 958,
    "version": 11,
    "event_modifier": 0,
    "event_id": 142,
    "event_name": "AUE_AUDITON_SPOLICY"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.auditd",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "3a8fc657d0760ad058d523e8b14eab0d2be5b29a",
    "team_id": "",
    "signer_type": 1
  },
  "key": "BA39A8B4-5C7C-47A4-80BC-8BE7B5183835",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "responsible_process_id": 44229,
    "process_name": "/usr/sbin/auditd",
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 0
    },
    "effective_group_id": 0,
    "user_id": 0,
    "process_id": 44229,
    "effective_group_name": "wheel",
    "effective_user_name": "root",
    "user_name": "root",
    "group_id": 0,
    "group_name": "wheel",
    "audit_id": 0,
    "audit_user_name": "root",
    "process_hash": "7e31f090cb89980640db07beeaa36fc5bb4886e6",
    "effective_user_id": 0,
    "session_id": 100245,
    "responsible_process_name": "/usr/sbin/auditd"
  }
}