AUE_SESSION_START

Début de session

Cet évènement est généré lors de l’ouverture d’une session utilisateur, par exemple lors de l’utilisation d’une fenêtre d’ouverture de session ou d’un protocole SSH.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_SESSION_START Example

Exemple de journal de télémétrie pour un début de session.

{
  "arguments": {
    "am_success": 0,
    "am_failure": 0,
    "sflags": 0
  },
  "exec_chain": {
    "uuid": "79997063-82EE-49EA-A394-9CE6D66C2771"
  },
  "exec_chain_child": {
    "parent_path": "",
    "parent_pid": -1,
    "parent_uuid": ""
  },
  "header": {
    "time_seconds_epoch": 1657906939,
    "time_milliseconds_offset": 714,
    "version": 11,
    "event_modifier": 0,
    "event_id": 44901,
    "event_name": "AUE_SESSION_START"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "key": "67C53C5B-4146-4E98-BD3D-D98C46019773",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100144,
    "group_id": 0,
    "process_name": "",
    "effective_user_name": "root",
    "user_id": 0,
    "group_name": "wheel",
    "parent_uuid": "",
    "uuid": "79997063-82EE-49EA-A394-9CE6D66C2771",
    "effective_group_id": 0,
    "process_hash": "",
    "audit_id": 4294967295,
    "responsible_process_id": 0,
    "process_id": 0,
    "parent_path": "",
    "effective_group_name": "wheel",
    "audit_user_name": "",
    "effective_user_id": 0,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 0
    },
    "responsible_process_name": "",
    "user_name": "root"
  }
}