{"name":"es_process_events","hostIdentifier":"HackBook.local","calendarTime":"Fri Apr  25 9:42:42 2025 UTC","unixTime":1745574162,"epoch":0,"counter":77,"numerics":false,"columns":{"cdhash":"","child_pid":"","cmdline":"osascript -e set memData to do shell script 'system_profiler SPMemoryDataType'if memData contains 'QEMU' or memData contains 'VMware' thendo shell script 'exit 42'elsedo shell script 'exit 0'end if","cmdline_count":"27","cwd":"/private/tmp","egid":"0","env":"TERM=unknown SHELL=/bin/sh USER=root SUDO_USER=root SUDO_UID=0 MAIL=/var/mail/root PATH=/usr/bin:/bin:/usr/sbin:/sbin PWD=/tmp SHLVL=1 SUDO_COMMAND=/etc/periodic/daily/110.clean-tmps HOME=/var/root LOGNAME=root SUDO_GID=0 OLDPWD=/ _=/usr/bin/osascript ","env_count":"15","euid":"0","event_type":"exec","exit_code":"","gid":"0","global_seq_num":"2453","original_parent":"1121","parent":"1121","path":"/usr/bin/osascript","pid":"1123","platform_binary":"1","seq_num":"1067","signing_id":"com.apple.osascript","team_id":"","time":"1646394622","uid":"0","username":"root","version":"4"},"action":"added"}