{"name":"es_process_events","hostIdentifier":"MacBookPro","calendarTime":"Tue Feb 17 16:22:16 2026 UTC","unixTime":1771345336,"epoch":0,"counter":486,"numerics":false,"columns":{"cdhash":"316c06db84711bdcf20013cdcec4c0625c77ecc4","child_pid":"","cmdline":"security dump-keychain -d /Library/Keychains/System.keychain ","cmdline_count":"4","codesigning_flags":"","cwd":"/Users/snap/Downloads","egid":"0","env":"SHELL=/bin/sh TERM=xterm-256color USER=root SUDO_USER=snap SUDO_UID=501 SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.614sLX07yb/Listeners __CF_USER_TEXT_ENCODING=0x0:0:0 MAIL=/var/mail/root PATH=/Users/snap/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/homebrew/bin:/Applications/iTerm.app/Contents/Resources/utilities PWD=/Users/snap/Downloads LANG=en_US.UTF-8 SHLVL=1 SUDO_COMMAND=/usr/bin/su HOME=/var/root COLORFGBG=15;0 LC_TERMINAL_VERSION=3.6.6 LOGNAME=root SUDO_GID=20 LC_TERMINAL=iTerm2 COLORTERM=truecolor _=/usr/bin/security OLDPWD=/Users/snap ","env_count":"22","euid":"0","event_type":"exec","exit_code":"","gid":"0","global_seq_num":"14310","original_parent":"40024","parent":"40024","parent_pidversion":"105354","path":"/usr/bin/security","pid":"42804","pidversion":"112415","platform_binary":"1","responsible_pid":"29792","responsible_pidversion":"83076","seq_num":"6012","session_id":"38273","signing_id":"com.apple.security","team_id":"","time":"1771345328","uid":"0","username":"root","version":"8"},"action":"added"}
{"name":"es_process_events","hostIdentifier":"MacBookPro","calendarTime":"Fri Feb 13 14:24:39 2026 UTC","unixTime":1770992679,"epoch":0,"counter":113,"numerics":false,"columns":{"cdhash":"316c06db84711bdcf20013cdcec4c0625c77ecc4","child_pid":"","cmdline":"security dump-keychain -d /var/root/Library/Keychains/login.keychain-db ","cmdline_count":"4","codesigning_flags":"","cwd":"/Users/snap","egid":"0","env":"SHELL=/bin/sh TERM=xterm-256color USER=root SUDO_USER=snap SUDO_UID=501 SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.614sLX07yb/Listeners __CF_USER_TEXT_ENCODING=0x0:0:0 MAIL=/var/mail/root PATH=/Users/snap/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/homebrew/bin:/Applications/iTerm.app/Contents/Resources/utilities PWD=/Users/snap LANG=en_US.UTF-8 SHLVL=1 SUDO_COMMAND=/usr/bin/su HOME=/var/root COLORFGBG=15;0 LC_TERMINAL_VERSION=3.6.6 LOGNAME=root SUDO_GID=20 LC_TERMINAL=iTerm2 COLORTERM=truecolor _=/usr/bin/security ","env_count":"21","euid":"0","event_type":"exec","exit_code":"","gid":"0","global_seq_num":"4502","original_parent":"40024","parent":"40024","parent_pidversion":"105354","path":"/usr/bin/security","pid":"40033","pidversion":"105378","platform_binary":"1","responsible_pid":"29792","responsible_pidversion":"83076","seq_num":"1746","session_id":"38273","signing_id":"com.apple.security","team_id":"","time":"1770992670","uid":"0","username":"root","version":"8"},"action":"added"}
{"name":"es_process_events","hostIdentifier":"MacBookPro","calendarTime":"Fri Feb 13 14:23:51 2026 UTC","unixTime":1770992631,"epoch":0,"counter":108,"numerics":false,"columns":{"cdhash":"316c06db84711bdcf20013cdcec4c0625c77ecc4","child_pid":"","cmdline":"security dump-keychain -d /Library/Keychains/System.keychain ","cmdline_count":"4","codesigning_flags":"","cwd":"/Users/snap","egid":"0","env":"SHELL=/bin/sh TERM=xterm-256color USER=root SUDO_USER=snap SUDO_UID=501 SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.614sLX07yb/Listeners __CF_USER_TEXT_ENCODING=0x0:0:0 MAIL=/var/mail/root PATH=/Users/snap/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/homebrew/bin:/Applications/iTerm.app/Contents/Resources/utilities PWD=/Users/snap LANG=en_US.UTF-8 SHLVL=1 SUDO_COMMAND=/usr/bin/su HOME=/var/root COLORFGBG=15;0 LC_TERMINAL_VERSION=3.6.6 LOGNAME=root SUDO_GID=20 LC_TERMINAL=iTerm2 COLORTERM=truecolor _=/usr/bin/security ","env_count":"21","euid":"0","event_type":"exec","exit_code":"","gid":"0","global_seq_num":"4476","original_parent":"40024","parent":"40024","parent_pidversion":"105354","path":"/usr/bin/security","pid":"40026","pidversion":"105359","platform_binary":"1","responsible_pid":"29792","responsible_pidversion":"83076","seq_num":"1734","session_id":"38273","signing_id":"com.apple.security","team_id":"","time":"1770992629","uid":"0","username":"root","version":"8"},"action":"added"}
{"name":"es_process_events","hostIdentifier":"MacBookPro","calendarTime":"Fri Feb 13 14:23:04 2026 UTC","unixTime":1770992584,"epoch":0,"counter":103,"numerics":false,"columns":{"cdhash":"316c06db84711bdcf20013cdcec4c0625c77ecc4","child_pid":"","cmdline":"security dump-keychain -d /Library/Keychains/System.keychain ","cmdline_count":"4","codesigning_flags":"","cwd":"/Users/snap","egid":"20","env":"TERM_SESSION_ID=w0t1p0:1F21614A-2F19-4713-A24D-A9951971E483 SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.614sLX07yb/Listeners LC_TERMINAL_VERSION=3.6.6 COLORFGBG=15;0 ITERM_PROFILE=Default XPC_FLAGS=0x0 LANG=en_US.UTF-8 PWD=/Users/snap SHELL=/bin/zsh __CFBundleIdentifier=com.googlecode.iterm2 TERM_FEATURES=T3LrMSc7UUw9Ts3BFGsSyHNoSxF TERM_PROGRAM_VERSION=3.6.6 TERM_PROGRAM=iTerm.app PATH=/Users/snap/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/homebrew/bin:/Applications/iTerm.app/Contents/Resources/utilities LC_TERMINAL=iTerm2 COLORTERM=truecolor COMMAND_MODE=unix2003 TERM=xterm-256color TERMINFO_DIRS=/Applications/iTerm.app/Contents/Resources/terminfo:/usr/share/terminfo HOME=/Users/snap TMPDIR=/var/folders/sg/6jws44091859n2nyzprgv0nw0000gn/T/ USER=snap XPC_SERVICE_NAME=0 LOGNAME=snap __CF_USER_TEXT_ENCODING=0x0:0:0 ITERM_SESSION_ID=w0t1p0:1F21614A-2F19-4713-A24D-A9951971E483 SHLVL=1 OLDPWD=/Users/snap _=/usr/bin/security ","env_count":"29","euid":"20","event_type":"exec","exit_code":"","gid":"20","global_seq_num":"4439","original_parent":"38274","parent":"38274","parent_pidversion":"101434","path":"/usr/bin/security","pid":"40015","pidversion":"105329","platform_binary":"1","responsible_pid":"29792","responsible_pidversion":"83076","seq_num":"1715","session_id":"38273","signing_id":"com.apple.security","team_id":"","time":"1770992577","uid":"501","username":"snap","version":"8"},"action":"added"}