Title
#general
b

Brandon Mesa

11/04/2022, 2:51 PM
Hey all, happy friday! Looking at some macOS FIM events where "uid" is blank, anyone know why this would be the case or what it could implicitly mean?
s

sharvil

11/04/2022, 3:05 PM
I am assuming this is the
file_events
table (and not the
es_process_file_events
)…I will have to dive deeper in the code, but IIRC it’s only
CREATED
and
UPDATED
that populates those (I will have to double check in a bit)
3:05 PM
and it might require a join with the
file
table too
3:06 PM
similarly the
ms5,sha1,sha256
columns might require a join with the
hash
table
3:06 PM
but could be just a bug
3:08 PM
nvm, the join should be done by the code itself
b

Brandon Mesa

11/04/2022, 3:08 PM
Correct, these come from file_events
s

sharvil

11/04/2022, 4:26 PM
Is this on Ventura?
4:26 PM
I am wondering is this this related to permissions (Full Disk Access and such), or this is on any file?
b

Brandon Mesa

11/04/2022, 4:52 PM
This is on monterey, and primarily across a select number of files including primarily /private/etc/cups/certs/0 and some child objects in /private/var/root/Library/Caches/rtcreportingd/events/NRM_Events_*
4:56 PM
all actions on /private/etc/cups/certs/0 is "DELETED"
4:57 PM
I will probably end up excluding that file from the query
s

sharvil

11/04/2022, 6:10 PM
Thanks for the additional context, this maybe a bug/caveat, I will try to dig in deeper