Gatekeeper

Overview

Evidence: Gatekeeper Description: Collect Gatekeeper details Category: Security Platform: macOS Short Name: gatek Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Gatekeeper is macOS's security feature that controls which applications can run on the system. This data is essential for understanding application security policies, detecting bypassed security controls, and investigating application-based security incidents.## Data Collected

This collector gathers structured data about gatekeeper.

Gatekeeper Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Name	Record name	Example Record
Value	Record value	Example Value
Timestamp	Record timestamp	2023-10-15 14:30:25
Type	Record type	example
Status	Record status	active
UserID	User identifier	user123
Metadata	Additional metadata	{}

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.