Jamf Protect Telemetry V2 のログを収集する

以下でサポートされています。

このドキュメントでは、Google Security Operations フィードを設定して Jamf Protect Telemetry V2 のログを収集する方法について説明します。Jamf Protect Telemetry V2 ログフィールドが Google SecOps 内の統合データモデル（UDM）フィールドにマッピングされる方法について詳しく説明します。また、サポートされている Jamf Protect Telemetry V2 のバージョンを一覧表示します。

詳細については、Google SecOps へのデータの取り込みをご覧ください。

一般的なデプロイは、Jamf Protect Telemetry V2 と、Google SecOps にログを送信するように構成された Google SecOps フィードで構成されます。お客様のデプロイはそれぞれ異なり、より複雑になる場合もあります。

デプロイには次のコンポーネントが含まれます。

  • Jamf Protect Telemetry V2。ログの収集元となる Jamf Protect Telemetry V2 プラットフォーム。

  • Google SecOps フィード。Jamf Protect Telemetry からログを取得して Google SecOps にログを書き込む Google SecOps フィード。

  • Google SecOps。Google SecOps は、Jamf Protect Telemetry V2 のログを保持して分析します。

各ログは、特定のパーサーを使用して Unified Data Model（UDM）に正規化されます。このドキュメントの情報は、取り込みラベル JAMF_TELEMETRY_V2 に関連付けられたパーサーに適用されます。

始める前に

  • 最新バージョンの Jamf Protect テレメトリー V2 が設定されていることを確認します。
  • Jamf Protect バージョン 6.3.2 以降を使用していることを確認します。
  • デプロイ アーキテクチャ内のすべてのシステムが、UTC タイムゾーンで構成されていることを確認します。

Jamf Protect Telemetry V2 のログを取り込むように Google SecOps でフィードを構成する

Google SecOps で取り込みフィードを設定するには、Amazon S3 または Webhook を使用できますが、Amazon S3 を使用することをおすすめします。

Amazon S3 を使用して Google SecOps で取り込みフィードを設定する

  1. [SIEM Settings] > [Feeds] に移動します。
  2. [Add New] をクリックします。
  3. [ソースタイプ] として [Amazon S3] を選択します。
  4. Jamf Protect Telemetry V2 のフィードを作成するには、[ログタイプ] として [Jamf Protect Telemetry V2] を選択します。
  5. [次へ] をクリックします。
  6. 次の入力パラメータを構成します。
    • S3 URI: S3 コンテナを指す URI。
    • URI is a: URI で指定されたオブジェクトのタイプ。
    • ソース削除オプション: 転送後にファイルまたはディレクトリを削除するかどうか。
    • [アクセスキー] または [シークレット アクセスキー] を選択します。適切な認証情報の種類を選択します。
    • キー/トークン: S3 リソースにアクセスするための共有キーまたは SAS トークン。
  7. [次へ]、[送信] の順にクリックします。
  8. Jamf Protect Telemetry V2 で使用するフィード名から フィード ID をコピーします。

Webhook を使用して Google SecOps で取り込みフィードを設定する

  1. [SIEM Settings] > [Feeds] に移動します。
  2. [新しく追加] をクリックします。
  3. [フィード名] フィールドに、フィードの名前を入力します。
  4. [ソースタイプ] リストで、[Webhook] を選択します。
  5. Jamf Protect Telemetry V2 のフィードを作成するには、[ログタイプ] として [Jamf Protect Telemetry V2] を選択します。
  6. [次へ] をクリックします。
  7. 省略可: 次の入力パラメータの値を指定します。
    • Split delimiter: ログ行を区切るために使用される区切り文字（\n など）。
    • Asset namespace: アセットの名前空間。
    • Ingestion labels: このフィードのイベントに適用されるラベル。
  8. [次へ] をクリックします。
  9. [Finalize] 画面で新しいフィードの設定を確認し、[送信] をクリックします。
  10. [秘密鍵を生成する] をクリックして、このフィードを認証するためのシークレット キーを生成します。
  11. シークレット キーをコピーして安全に保存します。この秘密鍵を再び表示することはできません。必要に応じて、新しい秘密鍵を再生成できますが、この操作により以前の秘密鍵は無効になります。
  12. [詳細] タブで、[エンドポイント情報] フィールドから、フィードのエンドポイント URL をコピーします。Jamf Protect Telemetry V2 クライアント アプリケーションを設定するには、この HTTPS URL が必要です。
  13. [完了] をクリックします。

Webhook フィード用の API キーを作成する

  1. Google Cloud コンソール > [認証情報] に移動します。

    [認証情報] に移動

  2. [認証情報を作成] をクリックして [API キー] を選択します。

  3. API キーのアクセスを Google Security Operations API に制限します。

Webhook フィード用に Jamf Protect Telemetry V2 を設定する

  1. Jamf Protect Telemetry V2 アプリケーションで、関連するアクション構成に移動します。
  2. [アクションを作成] をクリックして、新しいデータ エンドポイントを追加します。
  3. プロトコルとして [HTTP] を選択します。
  4. [URL] フィールドに、Google Security Operations API エンドポイントの HTTPS URL を入力します。（これは、Webhook フィードの設定からコピーした [エンドポイント情報] フィールドです。すでに必要な形式になっています。）

  5. 次の形式でカスタム ヘッダーの一部として API キーと秘密鍵を指定して、認証を有効にします。

    X-goog-api-key = API_KEY
X-Webhook-Access-Key = SECRET

    推奨事項: API キーは URL 内ではなくヘッダーとして指定してください。Webhook クライアントがカスタム ヘッダーをサポートしていない場合は、次の形式のクエリ パラメータを使用して API キーと秘密鍵を指定できます。

    ENDPOINT_URL?key=API_KEY&secret=SECRET

    以下を置き換えます。

    • ENDPOINT_URL: フィードのエンドポイント URL。
    • API_KEY: Google Security Operations に対する認証に使用する API キー。
    • SECRET: フィードの認証用に生成した秘密鍵。

  6. [ログの収集] セクションで、[テレメトリー] を選択します。

  7. [送信] をクリックします。

Google SecOps フィードの詳細については、Google SecOps フィードのドキュメントをご覧ください。各フィードタイプの要件については、タイプ別のフィード構成をご覧ください。

フィードの作成時に問題が発生した場合は、Google SecOps サポートにお問い合わせください。

フィールド マッピング リファレンス

このセクションでは、Google SecOps パーサーが Jamf Protect Telemetry V2 フィールドを Google SecOps の統合データモデル（UDM）フィールドにマッピングする方法について説明します。

フィールド マッピング リファレンス: イベント識別子からイベントタイプへ

次の表に、JAMF_TELEMETRY_V2 ログタイプと対応する UDM のイベントの種類を示します。

Event Identifier Event Type
authentication USER_LOGIN
bios_uefi STATUS_UPDATE
btm_launch_item_add PROCESS_LAUNCH
btm_launch_item_remove PROCESS_TERMINATION
chroot FILE_MODIFICATION
cs_invalidated STATUS_UPDATE
exec PROCESS_LAUNCH
file_collection STATUS_UPDATE
gatekeeper_user_override STATUS_UPDATE
kextload STATUS_UPDATE
kextunload STATUS_UPDATE
log_collection STATUS_UPDATE
login_login USER_LOGIN
login_logout USER_LOGOUT
lw_session_lock USER_LOGOUT
lw_session_login USER_LOGIN
lw_session_logout USER_LOGOUT
lw_session_unlock USER_LOGIN
mount STATUS_UPDATE
od_attribute_set USER_RESOURCE_UPDATE_CONTENT
od_attribute_value_add STATUS_UPDATE
od_attribute_value_remove USER_RESOURCE_DELETION
od_create_group GROUP_CREATION
od_create_user USER_CREATION
od_delete_group GROUP_DELETION
od_delete_user USER_DELETION
od_disable_user USER_UNCATEGORIZED
od_enable_user USER_UNCATEGORIZED
od_group_add GROUP_MODIFICATION
od_group_remove GROUP_MODIFICATION
od_group_set GROUP_MODIFICATION
od_modify_password USER_CHANGE_PASSWORD
openssh_login USER_LOGIN
openssh_logout USER_LOGOUT
sudo STATUS_UPDATE
system_performance STATUS_UPDATE
unmount STATUS_UPDATE
profile_add SETTING_CREATION
profile_remove SETTING_DELETION
remount RESOURCE_CREATION
screensharing_attach USER_LOGIN
screensharing_detach USER_LOGOUT
settime STATUS_UPDATE
su USER_LOGIN
xp_malware_detected SCAN_FILE
xp_malware_remediated SCAN_FILE

フィールド マッピング リファレンス: JAMF_TELEMETRY_V2 - 共通フィールド

次の表に、JAMF_TELEMETRY_V2 ログタイプの一般的なフィールドと、対応する UDM フィールドを示します。

Log field UDM mapping Logic
action.result.result.auth security_result.action If the **event_type** log field value is < `8000`, and not equal to `113` or `112`, and the **action.result.result.auth** field is equal to **1**, then set `security_result.action` to **BLOCK**. Else, set `security_result.action` to **ALLOW**
principal.platform The principal.platform UDM field is set to MAC.
uuid metadata.product_log_id
time metadata.event_timestamp
metadata.product metadata.product_name
host.protectVersion metadata.product_version
metadata.vendor metadata.vendor_name
host.hostname principal.asset.hostname
host.os principal.platform_version
host.provisioningUDID principal.asset_id
host.serial principal.asset.hardware.serial_number
host.ips principal.ip Iterate through log field host.ips, then
host.ips log field is mapped to the principal.ip UDM field.
event_type additional.fields[event_type]
global_seq_num additional.fields[global_seq_num]
process.executable.path src.process.file.full_path
process.executable.stat.st_dev src.process.file.stat_dev
process.executable.stat.st_flags src.process.file.stat_flags
process.executable.stat.st_ino src.process.file.stat_inode
process.executable.stat.st_mode src.process.file.stat_mode
process.executable.stat.st_mtimespec src.process.file.last_modification_time
process.executable.stat.st_atimespec src.process.file.last_access_time
process.executable.stat.st_nlink src.process.file.stat_nlink
process.executable.stat.st_size src.process.file.size
process.executable.sha256 src.process.file.sha256
process.executable.sha1 src.process.file.sha1
process.signing_id src.process.file.signature_info.codesign.id
process.team_id additional.fields[process_team_id]
process.ppid additional.fields[process_ppid]
process.codesigning_flags additional.fields[process_codesigning_flags]
process.cdhash additional.fields[process_cdhash]
process.is_platform_binary additional.fields[process_is_platform_binary]
process.is_es_client additional.fields[process_is_es_client]
process.group_id additional.fields[process_group_id]
process.original_ppid additional.fields[process_original_ppid]
process.session_id additional.fields[process_session_id]
thread.uuid additional.fields[thread_uuid]
thread.thread_id additional.fields[thread_id]
seq_num additional.fields[seq_num]
mach_time additional.fields[mach_time]
version additional.fields[version]
process.audit_token.euid src.process.euid
process.audit_token.ruid src.process.ruid
process.audit_token.egid src.process.egid
process.audit_token.rgid src.process.rgid
process.audit_token.pgid src.process.pgid
process.audit_token.pid src.process.pid
process.audit_token.uuid src.process.product_specific_process_id
process.audit_token.signing_id additional.fields[process_audit_token_signing_id]
process.parent_audit_token.euid src.process.parent_process.euid
process.parent_audit_token.ruid src.process.parent_process.ruid
process.parent_audit_token.egid src.process.parent_process.egid
process.parent_audit_token.rgid src.process.parent_process.rgid
process.parent_audit_token.pgid src.process.parent_process.pgid
process.parent_audit_token.pid src.process.parent_process.pid
process.parent_audit_token.uuid src.process.parent_process.product_specific_process_id
process.parent_audit_token.signing_id src.process.parent_process.file.signature_info.codesign.id

フィールド マッピング リファレンス: event_type 別の Rawlog フィールドから UDM フィールドへのマッピング。

event_type: remount

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to remount.
metadata.description A file system has been remounted. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to RESOURCE_CREATION.
principal.user.userid The principal.user.userid UDM field is set to null.
event.remount.statfs.f_owner target.user.userid
event.remount.device.size target.file.size
event.remount.statfs.f_fstypename target.resource.resource_subtype
event.remount.statfs.f_mntfromname src.resource.name
event.remount.statfs.f_mntonname target.resource.name

event_type: screensharing_attach

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to screensharing_attach.
metadata.description A screen sharing session has attached to a graphical session. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
event.screensharing_attach.source_address src.ip
event.screensharing_attach.authentication_username target.user.user_display_name
event.screensharing_attach.session_username principal.user.user_display_name
event.screensharing_attach.viewer_appleid additional.fields[screensharing_attach.viewer_appleid]
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.
security_result.category If the event.screensharing_attach.success log field value is equal to false then, the security_result.category UDM field is set to AUTH_VIOLATION.

event_type: su

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to su.
metadata.description A user attempts to start a new shell using a substitute user identity. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.su.argv target.process.command_line If the event.su.argc log field value is not equal to 0 then,
iterate through log field event.su.argv, then event.su.argv log field is mapped to the target.process.command_line UDM field.
event.su.to_uid target.user.userid
event.su.to_username target.user.user_display_name
event.su.from_uid principal.user.userid
event.su.from_username principal.user.user_display_name

event_type: settime

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to settime.
metadata.description The system time was attempted to be set. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.

event_type: screensharing_detach

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to screensharing_detach.
metadata.description A screen sharing session has detached from a graphical session. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGOUT.
target.user.user_display_name The target.user.user_display_name UDM field is set to null.
event.screensharing_detach.source_address src.ip
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to mechanism.

event_type: xp_malware_remediated

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to xp_malware_remediated.
metadata.description Apple's XProtect remediated malware on the system. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to SCAN_FILE.
action.result.result.auth security_result.action
event.xp_malware_remediated.remediated_path target.file.full_path
event.xp_malware_remediated.action_type additional.fields[xp_malware_remediated.action_type]
event.xp_malware_remediated.success additional.fields[xp_malware_remediated.success]
event.xp_malware_remediated.incident_identifier security_result.threat_id
event.xp_malware_remediated.malware_identifier security_result.threat_name
event.xp_malware_remediated.signature_version security_result.rule_id

event_type: xp_malware_detected

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to xp_malware_detected.
metadata.description Apple's XProtect detected malware on the system. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to SCAN_FILE.
action.result.result.auth security_result.action
event.xp_malware_detected.detected_path target.file.full_path
event.xp_malware_detected.incident_identifier security_result.threat_id
event.xp_malware_detected.malware_identifier security_result.threat_name

event_type: authentication

Log field UDM mapping Logic
Check additional fields in conf
metadata.product_event_type The metadata.product_event_type UDM field is set to authentication.
metadata.description A user authentication has occurred. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
event.authentication.data.od.instigator.audit_token.pid principal.process.pid
event.authentication.data.od.instigator.audit_token.uuid principal.process.product_specific_process_id JamfProtect:%{event.authentication.data.od.instigator.audit_token.uuid} log field is mapped to the principal.process.product_specific_process_id UDM field.
event.authentication.data.od.instigator.audit_token.euid principal.process.euid
event.authentication.data.od.instigator.audit_token.ruid principal.process.ruid
event.authentication.data.od.instigator.audit_token.rgid principal.process.rgid
event.authentication.data.od.instigator.audit_token.pgid principal.process.pgid
event.authentication.data.od.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.authentication.data.od.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.authentication.data.od.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.authentication.data.od.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.authentication.data.od.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.authentication.data.od.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.authentication.data.od.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.authentication.data.od.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id JamfProtect:%{event.authentication.data.od.instigator.parent_audit_token.uuid} log field is mapped to the principal.process.parent_process.product_specific_process_id UDM field.
event.authentication.data.od.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.authentication.data.od.instigator.executable.path principal.process.file.full_path
event.authentication.data.od.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.authentication.data.od.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.authentication.data.od.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.authentication.data.od.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.authentication.data.od.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.authentication.data.od.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.authentication.data.od.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.authentication.data.od.instigator.executable.stat.st_size principal.process.file.size
event.authentication.data.od.instigator.executable.sha256 principal.process.file.sha256
event.authentication.data.od.instigator.executable.sha1 principal.process.file.sha1
event.authentication.data.od.instigator.signing_id additional.fields[authentication_data_od_instigator_signing_id]
event.authentication.data.od.instigator.team_id additional.fields[authentication_data_od_instigator_team_id]
event.authentication.data.od.instigator.ppid rincipal.process.parent_process.pid
event.authentication.data.od.instigator.codesigning_flags additional.fields[codesigning_flags]
event.authentication.data.od.instigator.cdhash additional.fields[cdhash]
event.authentication.data.od.instigator.is_platform_binary additional.fields[is_platform_binary]
event.authentication.data.od.instigator.is_es_client additional.fields[is_es_client]
event.authentication.data.od.instigator.group_id additional.fields[group_id]
event.authentication.data.od.instigator.original_ppid additional.fields[original_ppid]
event.authentication.data.od.instigator.session_id additional.fields[session_id]
event.authentication.data.touchid.instigator.audit_token.euid principal.process.euid
event.authentication.data.touchid.instigator.audit_token.ruid principal.process.ruid
event.authentication.data.touchid.instigator.audit_token.egid principal.process.egid
event.authentication.data.touchid.instigator.audit_token.rgid principal.process.rgid
event.authentication.data.touchid.instigator.audit_token.pgid principal.process.pgid
event.authentication.data.touchid.instigator.audit_token.pid principal.process.pid
event.authentication.data.touchid.instigator.audit_token.uuid principal.process.product_specific_process_id
event.authentication.data.touchid.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.authentication.data.touchid.instigator.parent_audit_token.euid principal.parent_process.parent_process.euid
event.authentication.data.touchid.instigator.parent_audit_token.ruid principal.parent_process.parent_process.ruid
event.authentication.data.touchid.instigator.parent_audit_token.egid principal.parent_process.parent_process.egid
event.authentication.data.touchid.instigator.parent_audit_token.rgid principal.parent_process.parent_process.rgid
event.authentication.data.touchid.instigator.parent_audit_token.pgid principal.parent_process.parent_process.pgid
event.authentication.data.touchid.instigator.parent_audit_token.pid principal.parent_process.parent_process.pid
event.authentication.data.touchid.instigator.parent_audit_token.uuid principal.parent_process.product_specific_process_id
event.authentication.data.touchid.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.authentication.data.touchid.instigator.executable.path principal.process.file.full_path
event.authentication.data.touchid.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.authentication.data.touchid.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.authentication.data.touchid.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.authentication.data.touchid.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.authentication.data.touchid.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.authentication.data.touchid.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.authentication.data.touchid.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.authentication.data.touchid.instigator.executable.stat.st_size principal.process.file.size
event.authentication.data.touchid.instigator.executable.sha256 principal.process.file.sha256
event.authentication.data.touchid.instigator.executable.sha1 principal.process.file.sha1
event.authentication.data.touchid.instigator.signing_id additional.fields[authentication_data_touch_id_instigator_signing_id]
event.authentication.data.touchid.instigator.team_id additional.fields[authentication_data_touch_id_instigator_team_id]
event.authentication.data.touchid.instigator.ppid additional.fields[authentication_data_touch_id_instigator_ppid]
event.authentication.data.touchid.instigator.codesigning_flags additional.fields[touchid_instigator_codesigning_flags]
event.authentication.data.touchid.instigator.cdhash additional.fields[touchid_instigator_cdhash]
event.authentication.data.touchid.instigator.is_platform_binary additional.fields[touchid_instigator_is_platform_binary]
event.authentication.data.touchid.instigator.is_es_client additional.fields[touchid_instigator_is_es_client]
event.authentication.data.touchid.instigator.group_id additional.fields[touchid_instigator_group_id]
event.authentication.data.touchid.instigator.original_ppid additional.fields[touchid_instigator_original_ppid]
event.authentication.data.touchid.instigator.session_id additional.fields[touchid_instigator_session_id]
event.authentication.data.token.instigator.audit_token.euid principal.process.euid
event.authentication.data.token.instigator.audit_token.ruid principal.process.ruid
event.authentication.data.token.instigator.audit_token.egid principal.process.egid
event.authentication.data.token.instigator.audit_token.rgid principal.process.rgid
event.authentication.data.token.instigator.audit_token.pgid principal.process.pgid
event.authentication.data.token.instigator.audit_token.pid principal.process.pid
event.authentication.data.token.instigator.audit_token.uuid principal.process.product_specific_process_id
event.authentication.data.token.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.authentication.data.token.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.authentication.data.token.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.authentication.data.token.instigator.parent_audit_token.egid process.parent_process.egid
event.authentication.data.token.instigator.parent_audit_token.rgid process.parent_process.rgid
event.authentication.data.token.instigator.parent_audit_token.pgid process.parent_process.pgid
event.authentication.data.token.instigator.parent_audit_token.pid process.parent_process.pid
event.authentication.data.token.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.authentication.data.token.instigator.parent_audit_token.signing_id process.parent_process.file.signature_info.codesign.id
event.authentication.data.token.instigator.executable.path principal.process.file.full_path
event.authentication.data.token.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.authentication.data.token.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.authentication.data.token.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.authentication.data.token.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.authentication.data.token.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.authentication.data.token.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.authentication.data.token.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.authentication.data.token.instigator.executable.stat.st_size principal.process.file.size
event.authentication.data.token.instigator.executable.sha256 principal.process.file.sha256
event.authentication.data.token.instigator.executable.sha1 principal.process.file.sha1
event.authentication.data.token.instigator.signing_id additional.fields[authentication_data_token_instigator_signing_id]
event.authentication.data.token.instigator.team_id additional.fields[authentication_data_token_instigator_team_id]
event.authentication.data.token.instigator.ppid additional.fields[authentication_data_token_instigator_ppid]
event.authentication.data.token.instigator.codesigning_flags additional.fields[instigator_codesigning_flags]
event.authentication.data.token.instigator.cdhash additional.fields[instigator_cdhash]
event.authentication.data.token.instigator.is_platform_binary additional.fields[instigator_is_platform_binary]
event.authentication.data.token.instigator.is_es_client additional.fields[instigator_is_es_client]
event.authentication.data.token.instigator.group_id additional.fields[instigator_group_id]
event.authentication.data.token.instigator.original_ppid additional.fields[instigator_original_ppid]
event.authentication.data.token.instigator.session_id additional.fields[instigator_session_id]
event.authentication.data.od.record_name target.user.user_display_name
event.authentication.data.od.db_path additional.fields[db_path]
event.authentication.data.od.node_name additional.fields[node_name]
event.authentication.data.od.record_type additional.fields[record_type]
event.authentication.data.touchid.uid target.user.userid
event.authentication.data.touchid.touchid_mode additional.fields[authentication_data_touchid_touchid_mode]
event.authentication.data.token.pubkey_hash additional.fields[authentication_data_token_pubkey_hash]
event.authentication.data.token.token_id additional.fields[authentication_data_token_token_id]
event.authentication.data.token.kerberos_principal additional.fields[authentication_data_token_kerberos_principal]
event.authentication.data.auto_unlock.username target.user.user_display_name
event.authentication.data.auto_unlock.type additional.fields[authentication_data_auto_unlock_type]
event.authentication.type extensions.auth.mechanism If the event.authentication.type log field value is equal to 0 then, the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
Else If the event.authentication.type log field value is equal to 1 then, the extensions.auth.mechanism UDM field is set to MECHANISM_OTHER.
Else If the event.authentication.type log field value is equal to 2 then, the extensions.auth.mechanism UDM field is set to HARDWARE_KEY.
Else, the extensions.auth.mechanism UDM field is set to MECHANISM_OTHER.
event.authentication.success security_result.category If the event.authentication.success log field value is equal to false then, the security_result.category UDM field is set to AUTH_VIOLATION.

event_type: btm_launch_item_add

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to btm_launch_item_add.
metadata.description Apple's Background Task Manager notifies that a new persistence item has been added. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to PROCESS_LAUNCH.
event.btm_launch_item_add.instigator.audit_token.euid principal.process.euid
event.btm_launch_item_add.instigator.audit_token.ruid principal.process.ruid
event.btm_launch_item_add.instigator.audit_token.egid principal.process.egid
event.btm_launch_item_add.instigator.audit_token.rgid principal.process.rgid
event.btm_launch_item_add.instigator.audit_token.pgid principal.process.pgid
event.btm_launch_item_add.instigator.audit_token.pid principal.process.pid
event.btm_launch_item_add.instigator.audit_token.uuid principal.process.product_specific_process_id
event.btm_launch_item_add.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.btm_launch_item_add.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.btm_launch_item_add.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.btm_launch_item_add.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.btm_launch_item_add.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.btm_launch_item_add.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.btm_launch_item_add.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.btm_launch_item_add.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.btm_launch_item_add.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.btm_launch_item_add.instigator.executable.path principal.process.file.full_path
event.btm_launch_item_add.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.btm_launch_item_add.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.btm_launch_item_add.instigator.executable.stat.stat_inode principal.process.file.stat_inode
event.btm_launch_item_add.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.btm_launch_item_add.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.btm_launch_item_add.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.btm_launch_item_add.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.btm_launch_item_add.instigator.executable.stat.st_size principal.process.file.size
event.btm_launch_item_add.instigator.executable.sha256 principal.process.file.sha256
event.btm_launch_item_add.instigator.executable.sha1 principal.process.file.sha1
event.btm_launch_item_add.instigator.signing_id additional.fields[btm_launch_item_add_data_token_instigator_signing_id]
event.btm_launch_item_add.instigator.team_id additional.fields[btm_launch_item_add_data_token_instigator_team_id]
event.btm_launch_item_add.instigator.ppid additional.fields[btm_launch_item_add_data_token_instigator_ppid]
event.btm_launch_item_add.instigator.codesigning_flags additional.fields[btm_launch_item_add_instigator_codesigning_flags]
event.btm_launch_item_add.instigator.cdhash additional.fields[btm_launch_item_add_instigator_cdhash]
event.btm_launch_item_add.instigator.is_platform_binary additional.fields[btm_launch_item_add_instigator_is_platform_binary]
event.btm_launch_item_add.instigator.is_es_client additional.fields[btm_launch_item_add_instigator_is_es_client]
event.btm_launch_item_add.instigator.group_id additional.fields[btm_launch_item_add_instigator_group_id]
event.btm_launch_item_add.instigator.original_ppid additional.fields[btm_launch_item_add_instigator_original_ppid]
event.btm_launch_item_add.instigator.session_id additional.fields[btm_launch_item_add_instigator_session_id]
event.btm_launch_item_add.app.audit_token.euid target.process.euid
event.btm_launch_item_add.app.audit_token.ruid target.process.ruid
event.btm_launch_item_add.app.audit_token.egid target.process.egid
event.btm_launch_item_add.app.audit_token.rgid target.process.rgid
event.btm_launch_item_add.app.audit_token.pgid target.process.pgid
event.btm_launch_item_add.app.audit_token.pid target.process.pid
event.btm_launch_item_add.app.audit_token.uuid target.process.product_specific_process_id
event.btm_launch_item_add.app.audit_token.signing_id target.process.file.signature_info.codesign.id
event.btm_launch_item_add.app.parent_audit_token.euid target.process.parent_process.euid
event.btm_launch_item_add.app.parent_audit_token.ruid target.process.parent_process.ruid
event.btm_launch_item_add.app.parent_audit_token.egid target.process.parent_process.egid
event.btm_launch_item_add.app.parent_audit_token.rgid target.process.parent_process.rgid
event.btm_launch_item_add.app.parent_audit_token.pid target.process.parent_process.pid
event.btm_launch_item_add.app.parent_audit_token.uuid target.process.parent_process.product_specific_process_id
event.btm_launch_item_add.app.parent_audit_token.signing_id target.process.parent_process.file.signature_info.codesign.id
event.btm_launch_item_add.app.executable.path target.process.file.full_path
event.btm_launch_item_add.app.executable.stat.st_dev target.process.file.stat_dev
event.btm_launch_item_add.app.executable.stat.st_flags target.process.file.stat_flags
event.btm_launch_item_add.app.executable.stat.st_ino target.process.file.stat_inode
event.btm_launch_item_add.app.executable.stat.st_mode target.process.file.stat_mode
event.btm_launch_item_add.app.executable.stat.st_mtimespec target.process.file.last_modification_time
event.btm_launch_item_add.app.executable.stat.st_atimespec target.process.file.last_access_time
event.btm_launch_item_add.app.executable.stat.st_nlink target.process.file.stat_nlink
event.btm_launch_item_add.app.executable.stat.st_size target.process.file.size
event.btm_launch_item_add.app.executable.sha256 target.process.file.sha256
event.btm_launch_item_add.app.executable.sha1 target.process.file.sha1
event.btm_launch_item_add.app.signing_id additional.fields[btm_launch_item_add_app_signing_id]
event.btm_launch_item_add.app.team_id additional.fields[btm_launch_item_add_app_team_id]
event.btm_launch_item_add.app.ppid additional.fields[btm_launch_item_add_app_ppid]
event.btm_launch_item_add.app.codesigning_flags additional.fields[btm_launch_item_add_app_codesigning_flags]
event.btm_launch_item_add.app.cdhash additional.fields[btm_launch_item_add_app_cdhash]
event.btm_launch_item_add.app.is_platform_binary additional.fields[btm_launch_item_add_app_is_platform_binary]
event.btm_launch_item_add.app.is_es_client additional.fields[btm_launch_item_add_app_is_es_client]
event.btm_launch_item_add.app.group_id additional.fields[btm_launch_item_add_app_group_id]
event.btm_launch_item_add.app.original_ppid additional.fields[btm_launch_item_add_app_group_id]
event.btm_launch_item_add.app.session_id additional.fields[btm_launch_item_add_app_session_id]
event.btm_launch_item_add.executable_path target.file.full_path If the event.btm_launch_item_add.item.item_type log field value is equal to 4 or the event.btm_launch_item_add.item.item_type log field value is equal to 3 and if the event.btm_launch_item_add.executable_path log field value is not empty and if the event.btm_launch_item_add.executable_path log field value matches the regular expression pattern /^file:./ or the event.btm_launch_item_add.executable_path log field value does not match the regular expression pattern /^[a-zA-Z0-9] then, event.btm_launch_item_add.executable_path log field is mapped to the target.file.full_path UDM field.
Else, %{event.btm_launch_item_add.item.app_url}%{event.btm_launch_item_add.executable_path} log field is mapped to the target.file.full_path UDM field.
Else If the event.btm_launch_item_add.item.item_url log field value is not empty and if the event.btm_launch_item_add.item.item_url log field value matches the regular expression pattern /^file:./ or the event.btm_launch_item_add.item.item_url log field value does not match the regular expression pattern /^[a-zA-Z0-9] then, event.btm_launch_item_add.item.item_url log field is mapped to the target.resource.name UDM field.
Else, %{event.btm_launch_item_add.item.app_url}%{event.btm_launch_item_add.item.item_url} log field is mapped to the target.resource.name UDM field.
event.btm_launch_item_add.item.item_url target.file.full_path If the event.btm_launch_item_add.item.item_type log field value is equal to 0 or the event.btm_launch_item_add.item.item_type log field value is equal to 1 or the event.btm_launch_item_add.item.item_type log field value is equal to 2 and if the event.btm_launch_item_add.item.item_url log field value is not empty and if the event.btm_launch_item_add.item.item_url log field value matches the regular expression pattern /^file:./ or the event.btm_launch_item_add.item.item_url log field value does not match the regular expression pattern /^[a-zA-Z0-9] then the event.btm_launch_item_add.item.item_url log field is mapped to the target.file.full_path UDM field.
Else, %{event.btm_launch_item_add.item.app_url}%{event.btm_launch_item_add.item.item_url} log field is mapped to the target.file.full_path UDM field.
event.btm_launch_item_add.item.uid target.user.userid
event.btm_launch_item_add.item.item_type target.application If the event.btm_launch_item_add.item.item_type log field value is equal to 0 then, the target.application UDM field is set to USER_ITEM.
Else, if event.btm_launch_item_add.item.item_type log field value is equal to 1 then, the target.application UDM field is set to APP.
Else, if event.btm_launch_item_add.item.item_type log field value is equal to 2 then, the target.application UDM field is set to LOGIN_ITEM.
Else, if event.btm_launch_item_add.item.item_type log field value is equal to 3 then, the target.application UDM field is set to AGENT.
Else, if event.btm_launch_item_add.item.item_type log field value is equal to 4 then, the target.application UDM field is set to DAEMON.
event.btm_launch_item_add.item.managed additional.fields[btm_launch_item_add_item_managed]
event.btm_launch_item_add.item.legacy additional.fields[btm_launch_item_add_item_legacy]

event_type: btm_launch_item_remove

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to btm_launch_item_remove.
metadata.description Apple's Background Task Manager notified that an item has been removed. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to PROCESS_TERMINATION.
event.btm_launch_item_remove.instigator.audit_token.euid principal.process.euid
event.btm_launch_item_remove.instigator.audit_token.ruid principal.process.ruid
event.btm_launch_item_remove.instigator.audit_token.egid principal.process.egid
event.btm_launch_item_remove.instigator.audit_token.rgid principal.process.rgid
event.btm_launch_item_remove.instigator.audit_token.pgid principal.process.pgid
event.btm_launch_item_remove.instigator.audit_token.pid principal.process.pid
event.btm_launch_item_remove.instigator.audit_token.uuid principal.process.product_specific_process_id
event.btm_launch_item_remove.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.btm_launch_item_remove.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.btm_launch_item_remove.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.btm_launch_item_remove.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.btm_launch_item_remove.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.btm_launch_item_remove.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.btm_launch_item_remove.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.btm_launch_item_remove.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.btm_launch_item_remove.instigator.executable.path principal.process.file.full_path
event.btm_launch_item_remove.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.btm_launch_item_remove.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.btm_launch_item_remove.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.btm_launch_item_remove.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.btm_launch_item_remove.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.btm_launch_item_remove.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.btm_launch_item_remove.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.btm_launch_item_remove.instigator.executable.stat.st_size principal.process.file.size
event.btm_launch_item_remove.instigator.executable.sha256 principal.process.file.sha256
event.btm_launch_item_remove.instigator.executable.sha1 principal.process.file.sha1
event.btm_launch_item_remove.instigator.codesigning_flags additional.fields[btm_launch_item_remove_instigator_codesigning_flags]
event.btm_launch_item_remove.instigator.cdhash additional.fields[btm_launch_item_remove_instigator_cdhash]
event.btm_launch_item_remove.instigator.is_es_client additional.fields[btm_launch_item_remove_instigator_is_es_client]
event.btm_launch_item_remove.instigator.group_id additional.fields[btm_launch_item_remove_instigator_group_id]
event.btm_launch_item_remove.instigator.original_ppid additional.fields[btm_launch_item_remove_instigator_original_ppid]
event.btm_launch_item_remove.instigator.session_id additional.fields[btm_launch_item_remove_instigator_session_id]
event.btm_launch_item_remove.app.audit_token.euid target.process.euid
event.btm_launch_item_remove.app.audit_token.ruid target.process.ruid
event.btm_launch_item_remove.app.audit_token.egid target.process.egid
event.btm_launch_item_remove.app.audit_token.rgid target.process.rgid
event.btm_launch_item_remove.app.audit_token.pgid target.process.pgid
event.btm_launch_item_remove.app.audit_token.pid target.process.pid
event.btm_launch_item_remove.app.audit_token.uuid target.process.product_specific_process_id
event.btm_launch_item_remove.app.audit_token.signing_id target.process.file.signature_info.codesign.id
event.btm_launch_item_remove.app.parent_audit_token.euid target.process.parent_process.euid
event.btm_launch_item_remove.app.parent_audit_token.ruid target.process.parent_process.ruid
event.btm_launch_item_remove.app.parent_audit_token.egid target.process.parent_process.egid
event.btm_launch_item_remove.app.parent_audit_token.rgid target.process.parent_process.rgid
event.btm_launch_item_remove.app.parent_audit_token.pgid target.process.parent_process.pgid
event.btm_launch_item_remove.app.parent_audit_token.pid target.process.parent_process.pid
event.btm_launch_item_remove.app.parent_audit_token.uuid target.process.parent_process.product_specific_process_id
event.btm_launch_item_remove.app.executable.path target.process.file.full_path
event.btm_launch_item_remove.app.executable.stat.st_dev target.process.file.stat_dev
event.btm_launch_item_remove.app.executable.stat.st_flags target.process.file.stat_flags
event.btm_launch_item_remove.app.executable.stat.st_ino target.process.file.stat_inode
event.btm_launch_item_remove.app.executable.stat.st_mode target.process.file.stat_mode
event.btm_launch_item_remove.app.executable.stat.st_mtimespec target.process.file.last_modification_time
event.btm_launch_item_remove.app.executable.stat.st_atimespec target.process.file.last_access_time
event.btm_launch_item_remove.app.executable.stat.st_nlink target.process.file.stat_nlink
event.btm_launch_item_remove.app.executable.stat.st_size target.process.file.size
event.btm_launch_item_remove.app.executable.sha256 target.process.file.sha256
event.btm_launch_item_remove.app.executable.sha1 target.process.file.sha1
event.btm_launch_item_remove.app.signing_id additional.fields[btm_launch_item_remove_app_signing_id]
event.btm_launch_item_remove.app.team_id additional.fields[btm_launch_item_remove_app_team]
event.btm_launch_item_remove.app.ppid additional.fields[btm_launch_item_remove_app_ppid]
event.btm_launch_item_remove.app.codesigning_flags additional.fields[btm_launch_item_remove_app_codesigning_flags]
event.btm_launch_item_remove.app.cdhash additional.fields[btm_launch_item_remove_app_cdhash]
event.btm_launch_item_remove.app.is_platform_binary additional.fields[additional.fields[btm_launch_item_remove_app_cdhash]]
event.btm_launch_item_remove.app.is_es_client additional.fields[additional.fields[btm_launch_item_remove_app_is_es_client]]
event.btm_launch_item_remove.app.group_id additional.fields[additional.fields[btm_launch_item_remove_app_group_id]]
event.btm_launch_item_remove.app.original_ppid additional.fields[additional.fields[btm_launch_item_remove_app_original_ppid]]
event.btm_launch_item_remove.app.session_id additional.fields[additional.fields[btm_launch_item_remove_app_session_id]]
event.btm_launch_item_remove.item.app_url target.file.full_path If the event.btm_launch_item_remove.item.item_url log field value is not empty and if the event.btm_launch_item_remove.item.item_url log field value matches the regular expression pattern /^file:./ or the event.btm_launch_item_remove.item.item_url log field value does not match the regular expression pattern /^[a-zA-Z0-9] then, event.btm_launch_item_remove.item.item_url log field is mapped to the target.file.full_path UDM field.
Else, %{event.btm_launch_item_remove.item.app_url}%{event.btm_launch_item_remove.item.item_url} log field is mapped to the target.file.full_path UDM field.
event.btm_launch_item_remove.item.item_url target.file.full_path If the event.btm_launch_item_remove.item.item_url log field value is not empty and if the event.btm_launch_item_remove.item.item_url log field value matches the regular expression pattern /^file:./ or the event.btm_launch_item_remove.item.item_url log field value does not match the regular expression pattern /^[a-zA-Z0-9] then, event.btm_launch_item_remove.item.item_url log field is mapped to the target.file.full_path UDM field.
Else, %{event.btm_launch_item_remove.item.app_url}%{event.btm_launch_item_remove.item.item_url} log field is mapped to the target.file.full_path UDM field.
event.btm_launch_item_remove.item.uid target.user.userid
event.btm_launch_item_remove.executable_path target.file.full_path
event.btm_launch_item_remove.item.item_type target.application If the event.btm_launch_item_remove.item.item_type log field value is equal to 0 then, the target.application UDM field is set to USER_ITEM.
Else, if event.btm_launch_item_remove.item.item_type log field value is equal to 1 then, the target.application UDM field is set to APP.
Else, if event.btm_launch_item_remove.item.item_type log field value is equal to 2 then, the target.application UDM field is set to LOGIN_ITEM.
Else, if event.btm_launch_item_remove.item.item_type log field value is equal to 3 then, the target.application UDM field is set to AGENT.
Else, if event.btm_launch_item_remove.item.item_type log field value is equal to 4 then, the target.application UDM field is set to DAEMON.
event.btm_launch_item_remove.item.managed additional.fields[btm_launch_item_remove_item_managed]
event.btm_launch_item_remove.item.legacy additional.fields[btm_launch_item_remove_item_legacy]
event.btm_launch_item_remove.app.parent_audit_token.signing_id target.process.parent_process.file.signature_info.codesign.id

event_type: chroot

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to chroot.
metadata.description A piece of software has changed its apparent root directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to FILE_MODIFICATION.
event.chroot.target.path target.file.full_path
event.chroot.target.stat.st_dev target.file.stat_dev
event.chroot.target.stat.st_flags target.file.stat_flags
event.chroot.target.stat.st_ino target.file.stat_inode
event.chroot.target.stat.st_mode target.file.stat_mode
event.chroot.target.stat.st_mtimespec target.file.last_modification_time
event.chroot.target.stat.st_atimespec target.file.last_access_time
event.chroot.target.stat.st_nlink target.file.stat_nlink
event.chroot.target.stat.st_size target.file.size
event.chroot.target.sha256 target.file.sha256
event.chroot.target.sha1 target.file.sha1

event_type: exec

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to exec.
metadata.description An executable has been loaded into memory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to PROCESS_LAUNCH.
process.responsible_audit_token.euid principal.process.euid
process.responsible_audit_token.ruid principal.process.ruid
process.responsible_audit_token.egid principal.process.egid
process.responsible_audit_token.rgid principal.process.rgid
process.responsible_audit_token.pgid principal.process.pgid
process.responsible_audit_token.pid principal.process.pid
process.responsible_audit_token.uuid principal.process.product_specific_process_id
process.responsible_audit_token.signing_id principal.process.file.signature_info.codesign.id
event.exec.target.audit_token.euid target.process.euid
event.exec.target.audit_token.ruid target.process.ruid
event.exec.target.audit_token.egid target.process.egid
event.exec.target.audit_token.rgid target.process.rgid
event.exec.target.audit_token.pgid target.process.pgid
event.exec.target.audit_token.pid target.process.pid
event.exec.target.audit_token.uuid target.process.product_specific_process_id
event.exec.target.parent_audit_token.euid target.process.parent_process.euid
event.exec.target.parent_audit_token.ruid target.process.parent_process.ruid
event.exec.target.parent_audit_token.egid target.process.parent_process.egid
event.exec.target.parent_audit_token.rgid target.process.parent_process.rgid
event.exec.target.parent_audit_token.pgid target.process.parent_process.pgid
event.exec.target.parent_audit_token.pid target.process.parent_process.pid
event.exec.target.parent_audit_token.uuid target.process.parent_process.product_specific_process_id
event.exec.target.parent_audit_token.signing_id target.process.parent_process.file.signature_info.codesign.id
event.exec.target.executable.path target.process.file.full_path
event.exec.target.executable.stat.st_dev target.process.file.stat_dev
event.exec.target.executable.stat.st_flags target.process.file.stat_flags
event.exec.target.executable.stat.st_ino target.process.file.stat_inode
event.exec.target.executable.stat.st_mode target.process.file.stat_mode
event.exec.target.executable.stat.st_mtimespec target.process.file.last_modification_time
event.exec.target.executable.stat.st_atimespec target.process.file.last_access_time
event.exec.target.executable.stat.st_nlink target.process.file.stat_nlink
event.exec.target.executable.stat.st_size target.process.file.size
event.exec.target.executable.sha256 target.process.file.sha256
event.exec.target.executable.sha1 target.process.file.sha1
event.exec.target.signing_id additional.fields[exec_target_signing_id]
event.exec.target.team_id additional.fields[exec_target_team_id]
event.exec.target.ppid additional.fields[exec_target_ppid]
event.exec.target.codesigning_flags additional.fields[exec_target_codesigning_flags]
event.exec.target.cdhash additional.fields[exec_target_cdhash]
event.exec.target.is_platform_binary additional.fields[exec_target_is_platform_binary]
event.exec.target.is_es_client additional.fields[exec_target_is_es_client]
event.exec.target.group_id additional.fields[exec_target_group_id]
event.exec.target.original_ppid additional.fields[exec_target_original_ppid]
event.exec.target.session_id additional.fields[exec_target_session_id]
event.exec.args target.process.command_line
event.exec.cwd.path additional.fields[exec_cwd_path]
event.exec.dyld_exec_path additional.fields[exec_dyld_exec_path]
event.exec.script.path additional.fields[exec_script_path]
event.exec.tty.path additional.fields[exec_tty_path]
event.exec.image_cpusubtype additional.fields[exec_image_cpusubtype]
event.exec.image_cputype additional.fields[exec_image_cputype]
event.exec.target.audit_token.signing_id target.process.file.signature_info.codesign.id

event_type: file_collection

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to file_collection.
metadata.description Event occurs when data from a Diagnsostic or Crash Report file is collected from the system. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.file_collection.path target.file.path
event.file_collection.size target.file.size
event.file_collection.contents additional.fields[file_collection_contents]

event_type: kextload

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to kextload.
metadata.description A kernel extension (kext) was loaded. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.kextload.identifier target.resource.name

event_type: kextunload

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to kextunload.
metadata.description A kernel extension (kext) was unloaded. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.kextunload.identifier target.resource.name

event_type: log_collection

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to log_collection.
metadata.description Collection of entries from a local log file. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.log_collection.texts target.file.names
event.log_collection.path.0 target.file.full_path

event_type: login_login

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to login_login.
metadata.description A user attempted to log in via /usr/bin/login. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.login_login.uid target.user.userid
event.login_login.username target.user.user_display_name
event.login_login.success security_result.category If the event.login_login.success log field value is equal to false then, the security_result.category UDM field is set to AUTH_VIOLATION.
event.login_login.failure_message security_result.category_details If the event.login_login.success log field value is equal to false then, event.login_login.failure_message log field is mapped to the security_result.category_details UDM field.

event_type: login_logout

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to login_logout.
metadata.description A user logged out via /usr/bin/login. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGOUT.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.login_logout.uid target.user.userid
event.login_logout.username target.user.user_display_name

event_type: lw_session_login

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to lw_session_login.
metadata.description A user has logged in via the Login Window. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.lw_session_login.username target.user.user_display_name

event_type: bios_uefi

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to bios_uefi.
metadata.description Information about the current version of bios and uefi on the device. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.bios_uefi.firmware-version additional.fields[bios_uefi_firmware_version]
event.bios_uefi.system-firmware-version additional.fields[bios_uefi_system_firmware_version]
event.bios_uefi.architecture additional.fields[bios_uefi_architecture]
event.bios_uefi.bios.firmware-version additional.fields[bios_uefi_bios_firmware_version]
event.bios_uefi.bios.vendor additional.fields[bios_uefi_bios_vendor]
event.bios_uefi.bios.firmware-features additional.fields[bios_uefi_bios_firmware_features]
event.bios_uefi.bios.rom-size additional.fields[bios_uefi_bios_rom_size]
event.bios_uefi.bios.booter-version additional.fields[bios_uefi_bios_booter_version]

event_type: cs_invalidated

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to cs_invalidated.
metadata.description A process has had its code signature marked as invalid. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.

event_type: gatekeeper_user_override

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to gatekeeper_user_override.
metadata.description A user overrides Gatekeeper. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.gatekeeper_user_override.file.path target.file.full_path
event.gatekeeper_user_override.file.stat.st_dev target.file.stat_dev
event.gatekeeper_user_override.file.stat.st_flags target.file.stat_flags
event.gatekeeper_user_override.file.stat.st_ino target.file.stat_inode
event.gatekeeper_user_override.file.stat.st_mode target.file.stat_mode
event.gatekeeper_user_override.file.stat.st_mtimespec target.file.last_modification_time
event.gatekeeper_user_override.file.stat.st_atimespec target.file.last_access_time
event.gatekeeper_user_override.file.stat.st_nlink target.file.stat_nlink
event.gatekeeper_user_override.file.stat.st_size target.file.size
event.gatekeeper_user_override.file.sha256 target.file.sha256
event.gatekeeper_user_override.file.sha1 target.file.sha1
event.gatekeeper_user_override.signing_info.signing_id additional.fields[exec_gatekeeper_user_override_signing_info_signing_id]
event.gatekeeper_user_override.signing_info.team_id additional.fields[gatekeeper_user_override_signing_info_team_id]
event.gatekeeper_user_override.signing_info.cdhash additional.fields[gatekeeper_user_override_signing_info_cdhash]
event.gatekeeper_user_override.file_type additional.fields[gatekeeper_user_override_file_type]
event.gatekeeper_user_override.sha256 additional.fields[gatekeeper_user_override_sha256]

event_type: lw_session_unlock

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to lw_session_unlock.
metadata.description A user has unlocked the screen from the Login Window. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.lw_session_unlock.username target.user.user_display_name

event_type: lw_session_lock

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to lw_session_lock.
metadata.description A user has locked the screen. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGOUT.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.lw_session_lock.username target.user.user_display_name

event_type: lw_session_logout

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to lw_session_logout.
metadata.description A user has logged out of an active graphical session. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGOUT.
extensions.auth.type The extensions.auth.type UDM field is set to MACHINE.
event.lw_session_logout.username target.user.user_display_name

event_type: mount

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to mount.
metadata.description A file system has been mounted. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.mount.statfs.f_owner principal.user.userid
event.mount.device.size target.file.size
event.mount.statfs.f_fstypename target.resource.resource_subtype
event.mount.statfs.f_mntfromname src.resource.name
event.mount.statfs.f_mntonname target.resource.name
event.mount.device.protocol additional.fields[mount_device_protocol]
event.mount.disposition additional.fields[mount_disposition]
event.mount.device.serial_number target.asset.hardware.serial_number If the event.mount.device.serial_number log field value is not empty or the event.mount.device.vendor_name log field value is not empty or the event.mount.device.device_model log field value is not empty then, event.mount.device.serial_number log field is mapped to the target.asset.hardware.serial_number UDM field.
event.mount.device.vendor_name target.asset.hardware.manufacturer If the event.mount.device.serial_number log field value is not empty or the event.mount.device.vendor_name log field value is not empty or the event.mount.device.device_model log field value is not empty then, event.mount.device.vendor_name log field is mapped to the target.asset.hardware.manufacturer UDM field.
event.mount.device.device_model target.asset.hardware.model If the event.mount.device.serial_number log field value is not empty or the event.mount.device.vendor_name log field value is not empty or the event.mount.device.device_model log field value is not empty then, event.mount.device.device_model log field is mapped to the target.asset.hardware.model UDM field.

event_type: od_attribute_set

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_attribute_set.
metadata.description Attribute set on user or group using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_RESOURCE_UPDATE_CONTENT.
event.od_attribute_set.instigator.audit_token.euid principal.process.euid
event.od_attribute_set.instigator.audit_token.ruid principal.process.ruid
event.od_attribute_set.instigator.audit_token.egid principal.process.egid
event.od_attribute_set.instigator.audit_token.rgid principal.process.rgid
event.od_attribute_set.instigator.audit_token.pgid principal.process.pgid
event.od_attribute_set.instigator.audit_token.pid principal.process.pid
event.od_attribute_set.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_attribute_set.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_attribute_set.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_attribute_set.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_attribute_set.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_attribute_set.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_attribute_set.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_attribute_set.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_attribute_set.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_attribute_set.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_attribute_set.instigator.executable.path principal.process.file.full_path
event.od_attribute_set.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_attribute_set.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_attribute_set.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_attribute_set.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_attribute_set.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_attribute_set.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_attribute_set.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_attribute_set.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_attribute_set.instigator.executable.stat.st_size principal.process.file.size
event.od_attribute_set.instigator.executable.sha256 principal.process.file.sha256
event.od_attribute_set.instigator.executable.sha1 principal.process.file.sha1
event.od_attribute_set.instigator.signing_id additional.fields[od_attribute_set_instigator_signing_id]
event.od_attribute_set.instigator.team_id additional.fields[od_attribute_set_instigator_team_id]
event.od_attribute_set.instigator.ppid additional.fields[od_attribute_set_instigator_codesigning_flags]
event.od_attribute_set.instigator.codesigning_flags additional.fields[od_attribute_set_instigator_ppid]
event.od_attribute_set.instigator.cdhash additional.fields[od_attribute_set_instigator_cdhash]
event.od_attribute_set.instigator.is_platform_binary additional.fields[od_attribute_set_instigator_is_platform_binary]
event.od_attribute_set.instigator.is_es_client additional.fields[od_attribute_set_instigator_is_es_client]
event.od_attribute_set.instigator.group_id additional.fields[od_attribute_set_instigator_group_id]
event.od_attribute_set.instigator.original_ppid additional.fields[od_attribute_set_instigator_original_ppid]
event.od_attribute_set.instigator.session_id additional.fields[od_attribute_set_instigator_session_id]
event.od_attribute_set.attribute_name target.resource.resource_subtype
event.od_attribute_value_add.attribute_value target.resource.name
event.od_attribute_set.record_name target.user.user_display_name
event.od_attribute_set.instigator_token.euid principal.user.userid
event.od_attribute_set.db_path additional.fields[event_od_attribute_set_db_path]
event.od_attribute_set.node_name additional.fields[event_od_attribute_set_node_name]
event.od_attribute_set.record_type additional.fields[event_od_attribute_set_record_type]
event.od_attribute_set.error_code additional.fields[event_od_attribute_set_error_code]

event_type: od_attribute_value_add

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_attribute_value_add.
metadata.description Attribute set on user or group using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.od_attribute_value_add.instigator.audit_token.euid principal.process.euid
event.od_attribute_value_add.instigator.audit_token.ruid principal.process.ruid
event.od_attribute_value_add.instigator.audit_token.egid principal.process.egid
event.od_attribute_value_add.instigator.audit_token.rgid principal.process.rgid
event.od_attribute_value_add.instigator.audit_token.pgid principal.process.pgid
event.od_attribute_value_add.instigator.audit_token.pid principal.process.pid
event.od_attribute_value_add.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_attribute_value_add.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_attribute_value_add.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_attribute_value_add.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_attribute_value_add.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_attribute_value_add.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_attribute_value_add.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_attribute_set.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_attribute_value_add.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_attribute_value_add.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_attribute_value_add.instigator.executable.path principal.process.file.full_path
event.od_attribute_value_add.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_attribute_value_add.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_attribute_value_add.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_attribute_value_add.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_attribute_value_add.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_attribute_value_add.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_attribute_value_add.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_attribute_value_add.instigator.executable.stat.st_size principal.process.file.size
event.od_attribute_value_add.instigator.executable.sha256 principal.process.file.sha256
event.od_attribute_value_add.instigator.executable.sha1 principal.process.file.sha1
event.od_attribute_value_add.instigator.signing_id additional.fields[od_attribute_value_add_instigator_signing_id]
event.od_attribute_value_add.instigator.team_id additional.fields[od_attribute_value_add_instigator_team_id]
event.od_attribute_value_add.instigator.ppid additional.fields[od_attribute_value_add_instigator_ppid]
event.od_attribute_value_add.instigator.codesigning_flags additional.fields[od_attribute_set_instigator_codesigning_flags]
event.od_attribute_value_add.instigator.cdhash additional.fields[od_attribute_value_add_instigator_codesigning_flags]
event.od_attribute_value_add.instigator.is_platform_binary additional.fields[od_attribute_set_instigator_is_platform_binary]
event.od_attribute_value_add.instigator.is_es_client additional.fields[od_attribute_value_add_instigator_is_es_client]
event.od_attribute_value_add.instigator.group_id additional.fields[od_attribute_value_add_instigator_group_id]
event.od_attribute_value_add.instigator.original_ppid additional.fields[od_attribute_value_add_instigator_original_pp]
event.od_attribute_value_add.instigator.session_id additional.fields[od_attribute_value_add_instigator_session_id]
event.od_attribute_value_add.attribute_name target.resource.resource_subtype
event.od_attribute_value_add.attribute_value target.resource.name
event.od_attribute_value_add.record_name target.user.user_display_name
event.od_attribute_value_add.db_path additional.fields[od_attribute_value_add_db_path]
event.od_attribute_value_add.node_name additional.fields[od_attribute_value_add_node_name]
event.od_attribute_value_add.record_type additional.fields[od_attribute_value_add_record_type]
event.od_attribute_value_add.error_code additional.fields[od_attribute_value_add_error_code]

event_type: od_attribute_value_remove

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_attribute_value_remove.
metadata.description Attribute removed from a user or group using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_RESOURCE_DELETION.
event.od_attribute_value_remove.instigator.audit_token.euid principal.process.euid
event.od_attribute_value_remove.instigator.audit_token.ruid principal.process.ruid
event.od_attribute_value_remove.instigator.audit_token.egid principal.process.egid
event.od_attribute_value_remove.instigator.audit_token.rgid principal.process.rgid
event.od_attribute_value_remove.instigator.audit_token.pgid principal.process.pgid
event.od_attribute_value_remove.instigator.audit_token.pid principal.process.pid
event.od_attribute_value_remove.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_attribute_value_remove.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_attribute_value_remove.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_attribute_value_remove.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_attribute_value_remove.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_attribute_value_remove.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_attribute_value_remove.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_attribute_value_remove.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_attribute_value_remove.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_attribute_value_remove.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_attribute_value_remove.instigator.executable.path principal.process.file.full_path
event.od_attribute_value_remove.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_attribute_value_remove.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_attribute_value_remove.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_attribute_value_remove.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_attribute_value_remove.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_attribute_value_remove.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_attribute_value_remove.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_attribute_value_remove.instigator.executable.stat.st_size principal.process.file.size
event.od_attribute_value_remove.instigator.executable.sha256 principal.process.file.sha256
event.od_attribute_value_remove.instigator.executable.sha1 principal.process.file.sha1
event.od_attribute_value_remove.instigator.codesigning_flags additional.fields[od_attribute_value_remove_instigator_codesigning_flags]
event.od_attribute_value_remove.instigator.cdhash additional.fields[od_attribute_value_remove_instigator_codesigning_flags]
event.od_attribute_value_remove.instigator.is_platform_binary additional.fields[od_attribute_value_remove_instigator_is_platform_binary]
event.od_attribute_value_remove.instigator.is_es_client additional.fields[od_attribute_value_remove_instigator_is_es_client]
event.od_attribute_value_remove.instigator.group_id additional.fields[od_attribute_value_remove_instigator_group_id]
event.od_attribute_value_remove.instigator.original_ppid additional.fields[od_attribute_value_remove_instigator_original_pp]
event.od_attribute_value_remove.instigator.session_id additional.fields[od_attribute_value_remove_instigator_session_id]
event.od_attribute_value_remove.attribute_name target.resource.resource_subtype
event.od_attribute_value_remove.attribute_value target.resource.name
event.od_attribute_value_remove.record_name target.user.user_display_name
event.od_attribute_value_remove.db_path additional.fields[od_attribute_value_remove_db_path]
event.od_attribute_value_remove.node_name additional.fields[od_attribute_value_remove_node_name]
event.od_attribute_value_remove.record_type additional.fields[od_attribute_value_remove_record_type]
event.od_attribute_value_remove.error_code additional.fields[od_attribute_value_remove_error_code]

event_type: od_create_group

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_create_group.
metadata.description A group has been created using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to GROUP_CREATION.
event.od_create_group.instigator.audit_token.euid principal.process.euid
event.od_create_group.instigator.audit_token.ruid principal.process.ruid
event.od_create_group.instigator.audit_token.egid principal.process.egid
event.od_create_group.instigator.audit_token.rgid principal.process.rgid
event.od_create_group.instigator.audit_token.pgid principal.process.pgid
event.od_create_group.instigator.audit_token.pid principal.process.pid
event.od_create_group.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_create_group.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_create_group.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_create_group.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_create_group.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_create_group.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_create_group.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_create_group.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_create_group.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_create_group.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_create_group.instigator.executable.path principal.process.file.full_path
event.od_create_group.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_create_group.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_create_group.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_create_group.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_create_group.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_create_group.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_create_group.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_create_group.instigator.executable.stat.st_size principal.process.file.size
event.od_create_group.instigator.executable.sha256 principal.process.file.sha256
event.od_create_group.instigator.executable.sha1 principal.process.file.sha1
event.od_create_group.instigator.signing_id additional.fields[od_create_group_instigator_signing_id]
event.od_create_group.instigator.team_id additional.fields[od_create_group_instigator_team_id]
event.od_create_group.instigator.ppid additional.fields[od_create_group_instigator_ppid]
event.od_create_group.instigator.codesigning_flags additional.fields[od_create_group_instigator_codesigning_flags]
event.od_create_group.instigator.cdhash additional.fields[od_create_group_instigator_cdhash]
event.od_create_group.instigator.is_platform_binary additional.fields[od_create_group_instigator_is_platform_binary]
event.od_create_group.instigator.is_es_client additional.fields[od_create_group_instigator_is_es_client]
event.od_create_group.instigator.group_id additional.fields[od_create_group_instigator_group_id]
event.od_create_group.instigator.original_ppid additional.fields[od_create_group_instigator_original_pp]
event.od_create_group.instigator.session_id additional.fields[od_create_group_instigator_session_id]
event.od_create_group.group_name target.group.group_display_name
event.od_create_group.instigator_token.euid principal.user.userid
od_create_group.db_path additional.fields[od_create_group_db_path]
event.od_create_group.node_name additional.fields[od_create_group_node_name]
event.od_create_group.error_code additional.fields[od_create_group_error_code]

event_type: od_delete_group

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_delete_group.
metadata.description A group has been deleted using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to GROUP_DELETION.
event.od_delete_group.instigator.audit_token.euid principal.process.euid
event.od_delete_group.instigator.audit_token.ruid principal.process.ruid
event.od_delete_group.instigator.audit_token.egid principal.process.egid
event.od_delete_group.instigator.audit_token.rgid principal.process.rgid
event.od_delete_group.instigator.audit_token.pgid principal.process.pgid
event.od_delete_group.instigator.audit_token.pid principal.process.pid
event.od_delete_group.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_delete_group.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_delete_group.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_delete_group.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_delete_group.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_delete_group.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_delete_group.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_delete_group.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_delete_group.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_delete_group.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_delete_group.instigator.executable.path principal.process.file.full_path
event.od_delete_group.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_delete_group.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_delete_group.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_delete_group.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_delete_group.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_delete_group.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_delete_group.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_delete_group.instigator.executable.stat.st_size principal.process.file.size
event.od_delete_group.instigator.executable.sha256 principal.process.file.sha256
event.od_delete_group.instigator.executable.sha1 principal.process.file.sha1
event.od_delete_group.instigator.signing_id additional.fields[od_delete_group_instigator_signing_id]
event.od_delete_group.instigator.team_id additional.fields[od_delete_group_instigator_team_id]
event.od_delete_group.instigator.ppid additional.fields[od_delete_group_instigator_ppid]
event.od_delete_group.instigator.codesigning_flags additional.fields[od_delete_group_instigator_codesigning_flags]
event.od_delete_group.instigator.cdhash additional.fields[od_delete_group_instigator_cdhash]
event.od_delete_group.instigator.is_platform_binary additional.fields[od_delete_group_instigator_is_platform_binary]
event.od_delete_group.instigator.is_es_client additional.fields[od_delete_group_instigator_is_es_client]
event.od_delete_group.instigator.group_id additional.fields[od_delete_group_instigator_group_id]
event.od_delete_group.instigator.original_ppid additional.fields[od_delete_group_instigator_original_pp]
event.od_delete_group.instigator.session_id additional.fields[od_delete_group_instigator_session_id]
event.od_delete_group.group_name target.group.group_display_name
event.od_delete_group.instigator_token.euid principal.user.userid
od_delete_group.db_path additional.fields[od_delete_group_db_path]
event.od_delete_group.node_name additional.fields[od_delete_group_node_name]
event.od_delete_group.error_code additional.fields[od_delete_group_error_code]

event_type: od_create_user

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_create_user.
metadata.description A user has been created using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_CREATION.
event.od_create_user.instigator.audit_token.euid principal.process.euid
event.od_create_user.instigator.audit_token.ruid principal.process.ruid
event.od_create_user.instigator.audit_token.egid principal.process.egid
event.od_create_user.instigator.audit_token.rgid principal.process.rgid
event.od_create_user.instigator.audit_token.pgid principal.process.pgid
event.od_create_user.instigator.audit_token.pid principal.process.pid
event.od_create_user.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_create_user.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_create_user.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_create_user.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_create_user.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_create_user.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_create_user.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_create_user.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_create_user.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_create_user.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_create_user.instigator.executable.path principal.process.file.full_path
event.od_create_user.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_create_user.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_create_user.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_create_user.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_create_user.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_create_user.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_create_user.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_create_user.instigator.executable.stat.st_size principal.process.file.size
event.od_create_user.instigator.executable.sha256 principal.process.file.sha256
event.od_create_user.instigator.executable.sha1 principal.process.file.sha1
event.od_create_user.instigator.signing_id additional.fields[od_create_user_instigator_signing_id]
event.od_create_user.instigator.team_id additional.fields[od_create_user_instigator_team_id]
event.od_create_user.instigator.ppid additional.fields[od_create_user_instigator_ppid]
event.od_create_user.instigator.codesigning_flags additional.fields[od_create_user_instigator_codesigning_flags]
event.od_create_user.instigator.cdhash additional.fields[od_create_user_instigator_cdhash]
event.od_create_user.instigator.is_platform_binary additional.fields[od_create_user_instigator_is_platform_binary]
event.od_create_user.instigator.is_es_client additional.fields[od_create_user_instigator_is_es_client]
event.od_create_user.instigator.group_id additional.fields[od_create_user_instigator_group_id]
event.od_create_user.instigator.original_ppid additional.fields[od_create_user_instigator_original_pp]
event.od_create_user.instigator.session_id additional.fields[od_create_user_instigator_session_id]
event.od_create_user.user_name target.user.userid
event.od_create_user.instigator_token.euid principal.user.userid
event.od_create_user.db_path additional.fields[od_create_user_db_path]
event.od_create_user.node_name additional.fields[od_create_user_node_name]
event.od_create_user.error_code additional.fields[od_create_user_error_code]

event_type: od_delete_user

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_delete_user.
metadata.description A user has been deleted using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_DELETION.
event.od_delete_user.instigator.audit_token.euid principal.process.euid
event.od_delete_user.instigator.audit_token.ruid principal.process.ruid
event.od_delete_user.instigator.audit_token.egid principal.process.egid
event.od_delete_user.instigator.audit_token.rgid principal.process.rgid
event.od_delete_user.instigator.audit_token.pgid principal.process.pgid
event.od_delete_user.instigator.audit_token.pid principal.process.pid
event.od_delete_user.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_delete_user.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_delete_user.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_delete_user.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_delete_user.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_delete_user.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_delete_user.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_delete_user.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_delete_user.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_delete_user.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_delete_user.instigator.executable.path principal.process.file.full_path
event.od_delete_user.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_delete_user.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_delete_user.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_delete_user.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_delete_user.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_delete_user.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_delete_user.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_delete_user.instigator.executable.stat.st_size principal.process.file.size
event.od_delete_user.instigator.executable.sha256 principal.process.file.sha256
event.od_delete_user.instigator.executable.sha1 principal.process.file.sha1
event.od_delete_user.instigator.signing_id additional.fields[od_delete_user_instigator_signing_id]
event.od_delete_user.instigator.team_id additional.fields[od_delete_user_instigator_team_id]
event.od_delete_user.instigator.ppid additional.fields[od_delete_user_instigator_ppid]
event.od_delete_user.instigator.codesigning_flags additional.fields[od_delete_user_instigator_codesigning_flags]
event.od_delete_user.instigator.cdhash additional.fields[od_delete_user_instigator_cdhash]
event.od_delete_user.instigator.is_platform_binary additional.fields[od_delete_user_instigator_is_platform_binary]
event.od_delete_user.instigator.is_es_client additional.fields[od_delete_user_instigator_is_es_client]
event.od_delete_user.instigator.group_id additional.fields[od_delete_user_instigator_group_id]
event.od_delete_user.instigator.original_ppid additional.fields[od_delete_user_instigator_original_pp]
event.od_delete_user.instigator.session_id additional.fields[od_delete_user_instigator_session_id]
event.od_delete_user.user_name target.user.userid
event.od_delete_user.instigator_token.euid principal.user.userid
event.od_delete_user.db_path additional.fields[od_delete_user_db_path]
event.od_delete_user.node_name additional.fields[od_delete_user_node_name]
event.od_delete_user.error_code additional.fields[od_delete_user_error_code]
event.od_disable_user.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id

event_type: od_disable_user

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_disable_user.
metadata.description A user has been disabled using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_UNCATEGORIZED.
event.od_disable_user.instigator.audit_token.euid principal.process.euid
event.od_disable_user.instigator.audit_token.ruid principal.process.ruid
event.od_disable_user.instigator.audit_token.egid principal.process.egid
event.od_disable_user.instigator.audit_token.rgid principal.process.rgid
event.od_disable_user.instigator.audit_token.pgid principal.process.pgid
event.od_disable_user.instigator.audit_token.pid principal.process.pid
event.od_disable_user.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_disable_user.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_disable_user.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_disable_user.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_disable_user.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_disable_user.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_disable_user.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_disable_user.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_disable_user.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_disable_user.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_disable_user.instigator.executable.path principal.process.file.full_path
event.od_disable_user.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_disable_user.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_disable_user.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_disable_user.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_disable_user.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_disable_user.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_disable_user.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_disable_user.instigator.executable.stat.st_size principal.process.file.size
event.od_disable_user.instigator.executable.sha256 principal.process.file.sha256
event.od_disable_user.instigator.executable.sha1 principal.process.file.sha1
event.od_disable_user.instigator.codesigning_flags additional.fields[od_disable_user_instigator_codesigning_flags]
event.od_disable_user.instigator.cdhash additional.fields[od_disable_user_instigator_codesigning_flags]
event.od_disable_user.instigator.is_platform_binary additional.fields[od_disable_user_instigator_is_platform_binary]
event.od_disable_user.instigator.is_es_client additional.fields[od_disable_user_instigator_is_es_client]
event.od_disable_user.instigator.group_id additional.fields[od_disable_user_instigator_group_id]
event.od_disable_user.instigator.original_ppid additional.fields[od_disable_user_instigator_original_pp]
event.od_disable_user.instigator.session_id additional.fields[od_disable_user_instigator_session_id]
event.od_disable_user.user_name target.user.user_display_name
event.od_disable_user.instigator_token.euid principal.user.userid
event.od_disable_user.db_path additional.fields[od_disable_user_db_path]
event.od_disable_user.node_name additional.fields[od_disable_user_node_name]
event.od_disable_user.error_code additional.fields[od_disable_user_error_code]

event_type: od_enable_user

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_enable_user.
metadata.description A user has been enabled using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_UNCATEGORIZED.
event.od_enable_user.instigator.audit_token.euid principal.process.euid
event.od_enable_user.instigator.audit_token.ruid principal.process.ruid
event.od_enable_user.instigator.audit_token.egid principal.process.egid
event.od_enable_user.instigator.audit_token.rgid principal.process.rgid
event.od_enable_user.instigator.audit_token.pgid principal.process.pgid
event.od_enable_user.instigator.audit_token.pid principal.process.pid
event.od_enable_user.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_enable_user.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_enable_user.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_enable_user.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_enable_user.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_enable_user.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_enable_user.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_enable_user.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_enable_user.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_enable_user.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_enable_user.instigator.executable.path principal.process.file.full_path
event.od_enable_user.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_enable_user.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_enable_user.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_enable_user.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_enable_user.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_enable_user.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_enable_user.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_enable_user.instigator.executable.stat.st_size principal.process.file.size
event.od_enable_user.instigator.executable.sha256 principal.process.file.sha256
event.od_enable_user.instigator.executable.sha1 principal.process.file.sha1
event.od_enable_user.instigator.signing_id additional.fields[od_enable_user_instigator_signing_id]
event.od_enable_user.instigator.team_id additional.fields[od_enable_user_instigator_team_id]
event.od_enable_user.instigator.ppid additional.fields[od_enable_user_instigator_ppid]
event.od_enable_user.instigator.codesigning_flags additional.fields[od_enable_user_instigator_codesigning_flags]
event.od_enable_user.instigator.cdhash additional.fields[od_enable_user_instigator_cdhash]
event.od_enable_user.instigator.is_platform_binary additional.fields[od_enable_user_instigator_is_platform_binary]
event.od_enable_user.instigator.is_es_client additional.fields[od_enable_user_instigator_is_es_client]
event.od_enable_user.instigator.group_id additional.fields[od_enable_user_instigator_group_id]
event.od_enable_user.instigator.original_ppid additional.fields[od_enable_user_instigator_original_pp]
event.od_enable_user.instigator.session_id additional.fields[od_enable_user_instigator_session_id]
event.od_enable_user.user_name target.user.user_display_name
event.od_enable_user.instigator_token.euid principal.user.userid
event.od_enable_user.db_path additional.fields[od_enable_user_db_path]
event.od_enable_user.node_name additional.fields[od_enable_user_node_name]
event.od_enable_user.error_code additional.fields[od_enable_user_error_code]

event_type: od_group_add

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_group_add.
metadata.description A member has been added to a group using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to GROUP_MODIFICATION.
event.od_group_add.instigator.audit_token.euid principal.process.euid
event.od_group_add.instigator.audit_token.ruid principal.process.ruid
event.od_group_add.instigator.audit_token.egid principal.process.egid
event.od_group_add.instigator.audit_token.rgid principal.process.rgid
event.od_group_add.instigator.audit_token.pgid principal.process.pgid
event.od_group_add.instigator.audit_token.pid principal.process.pid
event.od_group_add.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_group_add.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_group_add.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_group_add.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_group_add.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_group_add.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_group_add.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_group_add.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_group_add.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_group_add.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_group_add.instigator.executable.path principal.process.file.full_path
event.od_group_add.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_group_add.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_group_add.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_group_add.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_group_add.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_group_add.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_group_add.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_group_add.instigator.executable.stat.st_size principal.process.file.size
event.od_group_add.instigator.executable.sha256 principal.process.file.sha256
event.od_group_add.instigator.executable.sha1 principal.process.file.sha1
event.od_group_add.instigator.signing_id additional.fields[od_group_add_instigator_signing_id]
event.od_group_add.instigator.team_id additional.fields[od_group_add_instigator_team_id]
event.od_group_add.instigator.ppid additional.fields[od_group_add_instigator_ppid]
event.od_group_add.instigator.codesigning_flags additional.fields[od_group_add_instigator_codesigning_flags]
event.od_group_add.instigator.cdhash additional.fields[od_group_add_instigator_cdhash]
event.od_group_add.instigator.is_platform_binary additional.fields[od_group_add_instigator_is_platform_binary]
event.od_group_add.instigator.is_es_client additional.fields[od_group_add_instigator_is_es_client]
event.od_group_add.instigator.group_id additional.fields[od_group_add_instigator_group_id]
event.od_group_add.instigator.original_ppid additional.fields[od_group_add_instigator_original_pp]
event.od_group_add.instigator.session_id additional.fields[od_group_add_instigator_session_id]
event.od_group_add.group_name target.group.group_display_name
event.od_group_add.member.member_value target.user.user_display_name
event.od_group_add.instigator_token.euid principal.user.userid
event.od_group_add.db_path additional.fields[od_group_add_db_path]
event.od_group_add.node_name additional.fields[od_group_add_node_name]
event.od_group_add.error_code additional.fields[od_group_add_error_code]

event_type: od_group_remove

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_group_remove.
metadata.description A member has been removed from a group using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to GROUP_MODIFICATION.
event.od_group_remove.instigator.audit_token.euid principal.process.euid
event.od_group_remove.instigator.audit_token.ruid principal.process.ruid
event.od_group_remove.instigator.audit_token.egid principal.process.egid
event.od_group_remove.instigator.audit_token.rgid principal.process.rgid
event.od_group_remove.instigator.audit_token.pgid principal.process.pgid
event.od_group_remove.instigator.audit_token.pid principal.process.pid
event.od_group_remove.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_group_remove.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_group_remove.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_group_remove.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_group_remove.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_group_remove.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_group_remove.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_group_remove.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_group_remove.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_group_remove.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_group_remove.instigator.executable.path principal.process.file.full_path
event.od_group_remove.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_group_remove.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_group_remove.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_group_remove.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_group_remove.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_group_remove.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_group_remove.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_group_remove.instigator.executable.stat.st_size principal.process.file.size
event.od_group_remove.instigator.executable.sha256 principal.process.file.sha256
event.od_group_remove.instigator.executable.sha1 principal.process.file.sha1
event.od_group_remove.instigator.signing_id additional.fields[od_group_remove_instigator_signing_id]
event.od_group_remove.instigator.team_id additional.fields[od_group_remove_instigator_team_id]
event.od_group_remove.instigator.ppid additional.fields[od_group_remove_instigator_ppid]
event.od_group_remove.instigator.codesigning_flags additional.fields[od_group_remove_instigator_codesigning_flags]
event.od_group_remove.instigator.cdhash additional.fields[od_group_remove_instigator_cdhash]
event.od_group_remove.instigator.is_platform_binary additional.fields[od_group_remove_instigator_is_platform_binary]
event.od_group_remove.instigator.is_es_client additional.fields[od_group_remove_instigator_is_es_client]
event.od_group_remove.instigator.group_id additional.fields[od_group_remove_instigator_group_id]
event.od_group_remove.instigator.original_ppid additional.fields[od_group_remove_instigator_original_pp]
event.od_group_remove.instigator.session_id additional.fields[od_group_remove_instigator_session_id]
event.od_group_remove.group_name target.group.group_display_name
event.od_group_remove.member.member_value target.user.user_display_name
event.od_group_remove.instigator_token.euid principal.user.userid
event.od_group_remove.db_path additional.fields[od_group_remove_db_path]
event.od_group_remove.node_name additional.fields[od_group_remove_node_name]
event.od_group_remove.error_code additional.fields[od_group_remove_error_code]

event_type: od_group_set

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_group_set.
metadata.description A group has a member initialized or replaced using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to GROUP_MODIFICATION.
event.od_group_set.instigator.audit_token.euid principal.process.euid
event.od_group_set.instigator.audit_token.ruid principal.process.ruid
event.od_group_set.instigator.audit_token.egid principal.process.egid
event.od_group_set.instigator.audit_token.rgid principal.process.rgid
event.od_group_set.instigator.audit_token.pgid principal.process.pgid
event.od_group_set.instigator.audit_token.pid principal.process.pid
event.od_group_set.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_group_set.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_group_set.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_group_set.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_group_set.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_group_set.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_group_set.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_group_set.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_group_set.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_group_set.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_group_set.instigator.executable.path principal.process.file.full_path
event.od_group_set.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_group_set.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_group_set.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_group_set.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_group_set.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_group_set.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_group_set.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_group_set.instigator.executable.stat.st_size principal.process.file.size
event.od_group_set.instigator.executable.sha256 principal.process.file.sha256
event.od_group_set.instigator.executable.sha1 principal.process.file.sha1
event.od_group_set.instigator.signing_id additional.fields[od_group_set_instigator_signing_id]
event.od_group_set.instigator.team_id additional.fields[od_group_set_instigator_team_id]
event.od_group_set.instigator.ppid additional.fields[od_group_set_instigator_ppid]
event.od_group_set.instigator.codesigning_flags additional.fields[od_group_set_instigator_codesigning_flags]
event.od_group_set.instigator.cdhash additional.fields[od_group_set_instigator_cdhash]
event.od_group_set.instigator.is_platform_binary additional.fields[od_group_set_instigator_is_platform_binary]
event.od_group_set.instigator.is_es_client additional.fields[od_group_set_instigator_is_es_client]
event.od_group_set.instigator.group_id additional.fields[od_group_set_instigator_group_id]
event.od_group_set.instigator.original_ppid additional.fields[od_group_set_instigator_original_pp]
event.od_group_set.instigator.session_id additional.fields[od_group_set_instigator_session_id]
event.od_group_set.group_name target.group.group_display_name
event.od_group_set.member.member_array target.user.user_display_name
event.od_group_set.instigator_token.euid principal.user.userid
event.od_group_set.db_path additional.fields[od_group_set_db_path]
event.od_group_set.node_name additional.fields[od_group_set_node_name]
event.od_group_set.error_code additional.fields[od_group_set_error_code]

event_type: od_modify_password

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to od_modify_password.
metadata.description A group has a member initialized or replaced using Open Directory. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_CHANGE_PASSWORD.
event.od_modify_password.instigator.audit_token.euid principal.process.euid
event.od_modify_password.instigator.audit_token.ruid principal.process.ruid
event.od_modify_password.instigator.audit_token.egid principal.process.egid
event.od_modify_password.instigator.audit_token.rgid principal.process.rgid
event.od_modify_password.instigator.audit_token.pgid principal.process.pgid
event.od_modify_password.instigator.audit_token.pid principal.process.pid
event.od_modify_password.instigator.audit_token.uuid principal.process.product_specific_process_id
event.od_modify_password.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.od_modify_password.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.od_modify_password.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.od_modify_password.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.od_modify_password.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.od_modify_password.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.od_modify_password.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.od_modify_password.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.od_modify_password.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.od_modify_password.instigator.executable.path principal.process.file.full_path
event.od_modify_password.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.od_modify_password.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.od_modify_password.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.od_modify_password.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.od_modify_password.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.od_modify_password.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.od_modify_password.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.od_modify_password.instigator.executable.stat.st_size principal.process.file.size
event.od_modify_password.instigator.executable.sha256 principal.process.file.sha256
event.od_modify_password.instigator.executable.sha1 principal.process.file.sha1
event.od_modify_password.instigator.signing_id additional.fields[od_modify_password_instigator_signing_id]
event.od_modify_password.instigator.team_id additional.fields[od_modify_password_instigator_team_id]
event.od_modify_password.instigator.ppid additional.fields[od_modify_password_instigator_ppid]
event.od_modify_password.instigator.codesigning_flags additional.fields[od_modify_password_instigator_codesigning_flags]
event.od_modify_password.instigator.cdhash additional.fields[od_modify_password_instigator_cdhash]
event.od_modify_password.instigator.is_platform_binary additional.fields[od_modify_password_instigator_is_platform_binary]
event.od_modify_password.instigator.is_es_client additional.fields[od_modify_password_instigator_is_es_client]
event.od_modify_password.instigator.group_id additional.fields[od_modify_password_instigator_group_id]
event.od_modify_password.instigator.original_ppid additional.fields[od_modify_password_instigator_original_pp]
event.od_modify_password.instigator.session_id additional.fields[od_modify_password_instigator_session_id]
event.od_modify_password.account_name target.user.user_display_name
event.od_modify_password.instigator_token.euid principal.user.userid
event.od_modify_password.db_path additional.fields[od_modify_password_db_path]
event.od_modify_password.node_name additional.fields[od_modify_password_node_name]
event.od_modify_password.error_code additional.fields[od_modify_password_error_code]

event_type: openssh_login

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to openssh_login.
metadata.description A user has logged into the system via OpenSSH. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
network.application_protocol The network.application_protocol UDM field is set to SSH.
event.openssh_login.source_address src.ip
event.openssh_login.uid target.user.userid
openssh_login.username target.user.user_display_name
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.
event.openssh_login.success security_result.category If the event.openssh_login.success log field value is equal to false then, the security_result.category UDM field is set to AUTH_VIOLATION.

event_type: openssh_logout

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to openssh_logout.
metadata.description A user has logged out of an OpenSSH session. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_LOGOUT.
network.application_protocol The network.application_protocol UDM field is set to SSH.
event.openssh_logout.source_address src.ip
event.openssh_logout.uid target.user.userid
openssh_logout.username target.user.user_display_name
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.

event_type: profile_add

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to openssh_logout.
metadata.description A configuration profile is installed on the system. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to SETTING_CREATION.
target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
event.profile_add.instigator.audit_token.euid principal.process.euid
event.profile_add.instigator.audit_token.ruid principal.process.ruid
event.profile_add.instigator.audit_token.egid principal.process.egid
event.profile_add.instigator.audit_token.rgid principal.process.rgid
event.profile_add.instigator.audit_token.pgid principal.process.pgid
event.profile_add.instigator.audit_token.pid principal.process.pid
event.profile_add.instigator.audit_token.uuid principal.process.product_specific_process_id
event.profile_add.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.profile_add.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.profile_add.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.profile_add.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.profile_add.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.profile_add.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.profile_add.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.profile_add.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.profile_add.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.profile_add.instigator.executable.path principal.process.file.full_path
event.profile_add.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.profile_add.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.profile_add.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.profile_add.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.profile_add.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.profile_add.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.profile_add.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.profile_add.instigator.executable.stat.st_size principal.process.file.size
event.profile_add.instigator.executable.sha256 principal.process.file.sha256
event.profile_add.instigator.executable.sha1 principal.process.file.sha1
event.profile_add.instigator.signing_id additional.fields[profile_add_instigator_signing_id]
event.profile_add.instigator.team_id additional.fields[profile_add_instigator_team_id]
event.profile_add.instigator.ppid additional.fields[profile_add_instigator_ppid]
event.profile_add.instigator.codesigning_flags additional.fields[profile_add_instigator_codesigning_flags]
event.profile_add.instigator.cdhash additional.fields[profile_add_instigator_cdhash]
event.profile_add.instigator.is_platform_binary additional.fields[profile_add_instigator_is_platform_binary]
event.profile_add.instigator.is_es_client additional.fields[profile_add_instigator_is_es_client]
event.profile_add.instigator.group_id additional.fields[profile_add_instigator_group_id]
event.profile_add.instigator.original_ppid additional.fields[profile_add_instigator_original_pp]
event.profile_add.instigator.session_id additional.fields[profile_add_instigator_session_id]
event.profile_add.profile.scope target.resource.resource_subtype
event.profile_add.profile.uuid target.resource.product_object_id
event.profile_add.profile.display_name target.resource.name
event.profile_add.is_update additional.fields[profile_add_is_update]
event.profile_add.profile.identifier additional.fields[profile_add_profile_identifier]
event.profile_add.profile.install_source additional.fields[profile_add_profile_install_source]
event.profile_add.profile.organization additional.fields[profile_add_profile_organization]

event_type: profile_remove

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to openssh_logout.
metadata.description A configuration profile is removed from the system. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to SETTING_DELETION.
target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
event.profile_remove.instigator.audit_token.euid principal.process.euid
event.profile_remove.instigator.audit_token.ruid principal.process.ruid
event.profile_remove.instigator.audit_token.egid principal.process.egid
event.profile_remove.instigator.audit_token.rgid principal.process.rgid
event.profile_remove.instigator.audit_token.pgid principal.process.pgid
event.profile_remove.instigator.audit_token.pid principal.process.pid
event.profile_remove.instigator.audit_token.uuid principal.process.product_specific_process_id
event.profile_remove.instigator.audit_token.signing_id principal.process.file.signature_info.codesign.id
event.profile_remove.instigator.parent_audit_token.euid principal.process.parent_process.euid
event.profile_remove.instigator.parent_audit_token.ruid principal.process.parent_process.ruid
event.profile_remove.instigator.parent_audit_token.egid principal.process.parent_process.egid
event.profile_remove.instigator.parent_audit_token.rgid principal.process.parent_process.rgid
event.profile_remove.instigator.parent_audit_token.pgid principal.process.parent_process.pgid
event.profile_remove.instigator.parent_audit_token.pid principal.process.parent_process.pid
event.profile_remove.instigator.parent_audit_token.uuid principal.process.parent_process.product_specific_process_id
event.profile_remove.instigator.parent_audit_token.signing_id principal.process.parent_process.file.signature_info.codesign.id
event.profile_remove.instigator.executable.path principal.process.file.full_path
event.profile_remove.instigator.executable.stat.st_dev principal.process.file.stat_dev
event.profile_remove.instigator.executable.stat.st_flags principal.process.file.stat_flags
event.profile_remove.instigator.executable.stat.st_ino principal.process.file.stat_inode
event.profile_remove.instigator.executable.stat.st_mode principal.process.file.stat_mode
event.profile_remove.instigator.executable.stat.st_mtimespec principal.process.file.last_modification_time
event.profile_remove.instigator.executable.stat.st_atimespec principal.process.file.last_access_time
event.profile_remove.instigator.executable.stat.st_nlink principal.process.file.stat_nlink
event.profile_remove.instigator.executable.stat.st_size principal.process.file.size
event.profile_remove.instigator.executable.sha256 principal.process.file.sha256
event.profile_remove.instigator.executable.sha1 principal.process.file.sha1
event.profile_remove.instigator.signing_id additional.fields[profile_remove_instigator_signing_id]
event.profile_remove.instigator.team_id additional.fields[profile_remove_instigator_team_id]
event.profile_remove.instigator.ppid additional.fields[profile_remove_instigator_ppid]
event.profile_remove.instigator.codesigning_flags additional.fields[profile_remove_instigator_codesigning_flags]
event.profile_remove.instigator.cdhash additional.fields[profile_remove_instigator_cdhash]
event.profile_remove.instigator.is_platform_binary additional.fields[profile_remove_instigator_is_platform_binary]
event.profile_remove.instigator.is_es_client additional.fields[profile_remove_instigator_is_es_client]
event.profile_remove.instigator.group_id additional.fields[profile_remove_instigator_group_id]
event.profile_remove.instigator.original_ppid additional.fields[profile_remove_instigator_original_pp]
event.profile_remove.instigator.session_id additional.fields[profile_remove_instigator_session_id]
event.profile_remove.profile.scope target.resource.resource_subtype
event.profile_remove.profile.uuid target.resource.product_object_id
event.profile_remove.profile.display_name target.resource.name
event.profile_remove.is_update additional.fields[profile_remove_is_update]
event.profile_remove.profile.identifier additional.fields[profile_remove_profile_identifier]
event.profile_remove.profile.install_source additional.fields[profile_remove_profile_install_source]
event.profile_remove.profile.organization additional.fields[profile_remove_profile_organization]

event_type: sudo

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to sudo.
metadata.description A sudo attempt occurred. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.sudo.reject_info.plugin_name additional.fields[sudo_reject_info_plugin_name]
event.sudo.reject_info.failure_message additional.fields[sudo_reject_info_failure_message]
event.sudo.reject_info.plugin_type additional.fields[sudo_reject_info_plugin_type]
event.sudo.from_uid principal.user.userid
event.sudo.from_username principal.user.user_display_name
event.sudo.command target.process.command_line
event.sudo.to_uid target.user.userid
event.sudo.to_username target.user.user_display_name
event.sudo.success security_result.category If the event.sudo.success log field value is equal to false then, the security_result.category UDM field is set to AUTH_VIOLATION.

event_type: system_performance

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to system_performance.
metadata.description Event occurs on a regular interval to collect application performance data. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.performance.metrics.hw_model additional.fields[performance_metrics_hw_model]
event.performance.page_info.page additional.fields[performance_page_info_page]
udm.performance.page_info.total additional.fields[performance_page_info_total]
event.performance.metrics.tasks.name additional.fields[task_name]
event.performance.metrics.tasks.energy_impact additional.fields[task_energy_impact]

event_type: unmount

Log field UDM mapping Logic
metadata.product_event_type The metadata.product_event_type UDM field is set to unmount.
metadata.description A file system has been unmounted. value is set to the metadata.description UDM field.
metadata.event_type The metadata.event_type UDM field is set to STATUS_UPDATE.
event.unmount.statfs.f_owner target.user.userid
event.unmount.device.size target.file.size
event.unmount.statfs.f_fstypename target.resource.resource_subtype
event.unmount.statfs.f_mntfromname target.resource.name
event.unmount.device.protocol additional.fields[unmount_device_protocol]
event.unmount.device.serial_number target.asset.hardware.serial_number If the event.unmount.device.serial_number log field value is not empty or the event.unmount.device.vendor_name log field value is not empty or the event.unmount.device.device_model log field value is not empty then, event.unmount.device.serial_number log field is mapped to the target.asset.hardware.serial_number UDM field.
event.unmount.device.device_model target.asset.hardware.model If the event.unmount.device.serial_number log field value is not empty or the event.unmount.device.vendor_name log field value is not empty or the event.unmount.device.device_model log field value is not empty then, event.unmount.device.device_model log field is mapped to the target.asset.hardware.model UDM field.
event.unmount.device.vendor_name target.asset.hardware.manudacturer If the event.unmount.device.serial_number log field value is not empty or the event.unmount.device.vendor_name log field value is not empty or the event.unmount.device.device_model log field value is not empty then, event.unmount.device.vendor_name log field is mapped to the target.asset.hardware.manufacturer UDM field.

さらにサポートが必要な場合 コミュニティ メンバーや Google SecOps のプロフェッショナルから回答を得ることができます。