[
    {
        "choices": [],
        "data_type": "string",
        "default_value": null,
        "description": "Most recent SAP Privileges administrator or standard-user change found in the local unified log. macOS controls log retention.",
        "display_name": "Privileges - Last Change",
        "field_name": "privileges_last_change",
        "is_global": true,
        "metadata": {
            "macos": {
                "must_exit_zero": true,
                "replace_line_feed": true,
                "source": "#!/bin/bash\n#\n# Returns the most recent SAP Privileges privilege-change event that remains in\n# the local unified log. Privileges 2.5.2 or later is required for the dedicated\n# subsystem and category used below.\n#\n# Output examples:\n#   jsmith: privilege=administrator reason=\"Installing an App\"\n#   jsmith: privilege=standard reason=\"privileges expired\"\n#\n\nWINDOW=\"7d\"\n\n/usr/bin/log show --style syslog \\\n  --predicate 'subsystem == \"corp.sap.privileges.daemon\" AND category == \"privchange\"' \\\n  --last \"$WINDOW\" | /usr/bin/perl -ne '\n    if (/SAPCorp: User (.+?) now has administrator privileges(?: for the following reason: \"(.*)\")?\\s*$/) {\n      $u=$1; $r=$2;\n      $out=sprintf(\"%s: privilege=administrator\",$u);\n      $out.=sprintf(\" reason=\\\"%s\\\"\",$r) if defined($r) && length($r);\n    } elsif (/SAPCorp: User (.+?) now has standard user privileges(?: \\((.*)\\))?\\s*$/) {\n      $u=$1; $r=$2;\n      $out=sprintf(\"%s: privilege=standard\",$u);\n      $out.=sprintf(\" reason=\\\"%s\\\"\",$r) if defined($r) && length($r);\n    }\n    END { print \"$out\\n\" if defined($out); }\n  '\n\nexit 0"
            },
            "windows": {
                "must_exit_zero": true,
                "replace_line_feed": true,
                "source": "# FileWave client will execute this script. The output will be used as the value of the custom field.\n# \n# Below is an example of how to read the value of one ENVIRONMENT VARIABLE in your script:\n\n# $my_var = $Env:ENV_VAR_NAME\n# \n\nexit 0"
            }
        },
        "provider": 1,
        "to_be_deleted": false
    }
]