Print Jobs

Overview

Evidence: Print Jobs Description: Collect print job info Category: System Platform: macos Short Name: prntjb Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

CUPS print job history records document printing activities on macOS. This data is essential for auditing data exfiltration attempts and user activity.

Data Collected

This collector gathers structured data about print jobs.

Print Jobs Data

Field	Description	Example
Title	Title	Example value
Destination	Destination	Example value
User	User	Example value
Format	Format	Example value
Size	Size	123
CompletedTime	Completed Time	2023-10-15 14:30:25+03:00
ProcessingTime	Processing Time	2023-10-15 14:30:25+03:00
CreationTime	Creation Time	2023-10-15 14:30:25+03:00

Collection Method

This collector queries the cups_jobs table via osquery and records results into print_job_info.

Forensic Value

This evidence is crucial for forensic investigations as it can indicate sensitive documents printed or unusual printing behavior.