Monitoring - event types

Elevate24 Session Reporting can log a variety of data points while the user is elevated. It's important to configure the event types and select the data you want to report on.

Event types

• Availability: Premium
• Type: Array

Specifies which event types Elevate24 will log during an elevated session. Add only the event types relevant to your security and compliance requirements.

<key>EventsToLog</key>
	<array>
		<dict>
			<key>eventType</key>
			<string>File:Write</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>File:Unlink</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>File:Clone</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>File:CopyFile</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>File:Create</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>File:Rename</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>User:Create</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>User:Delete</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>Profile:Add</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>Profile:Remove</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>LaunchItem:Add</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>LaunchItem:Remove</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>Sudo</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>Process:Exec</string>
		</dict>
	</array>

Parameters

Key	Type	Required	Description
eventType	String	Yes	The event type to log. See accepted values below.

Accepted event types

Value	Description
File:Write	A file was written to
File:Unlink	A file or directory was deleted
File:Clone	A file was cloned
File:CopyFile	A file was copied
File:Create	A new file was created
File:Rename	A file or directory was renamed
User:Create	A local user account was created
User:Delete	A local user account was deleted
Profile:Add	A configuration profile was installed
Profile:Remove	A configuration profile was removed
LaunchItem:Add	A launch agent or daemon was added
LaunchItem:Remove	A launch agent or daemon was removed
Sudo	A sudo command was executed. Enable Process:Exec alongside this event to ensure sudo activity is captured correctly in your reporting.
Process:Exec	A process was executed

---

Log all event types

• Availability: Premium
• Type: Boolean
• Default: false

Enables logging of all supported event types without needing to list them individually in EventsToLog.

<key>logAllEventTypes</key>
<true/>

WARNING

Enabling this option will report back every eventType as listed above. This could generate a significant volume of data. Use with caution.