AUE_REMOVE_FROM_GROUP

{
  "_event_score": 0,
  "exec_chain_child": {
    "parent_path": "/sbin/launchd",
    "parent_pid": 1,
    "parent_uuid": "072234D8-1BAB-47B6-82AC-0C275A190207"
  },
  "header": {
    "event_id": 45019,
    "event_modifier": 0,
    "event_name": "AUE_remove_from_group",
    "time_milliseconds_offset": 88,
    "time_seconds_epoch": 1570730184,
    "version": 11
  },
  "host_info": {
    "host_name": "Dan_macbook_pro",
    "host_uuid": "3F6E4B3A-9285-4E7E-9A0C-C3B62DC379DF",
    "osversion": "Version 10.15 (Build 19A582a)",
    "primary_mac_address": "38:f9:e8:15:5a:82",
    "serial_number": "C03XY889JHG3"
  },
  "identity": {
    "cd_hash": "85d569713637049c668874934c04a8dac3056ac1",
    "signer_id": "com.apple.opendirectoryd",
    "signer_id_truncated": 0,
    "signer_type": 1,
    "team_id": "",
    "team_id_truncated": 0
  },
  "return": {
    "description": "success",
    "error": 0,
    "return_value": 0
  },
  "subject": {
    "audit_id": 502,
    "audit_user_name": "dan",
    "effective_group_id": 20,
    "effective_group_name": "staff",
    "effective_user_id": 502,
    "effective_user_name": "dan",
    "group_id": 20,
    "group_name": "staff",
    "process_hash": "FCED4EC0FD369A22E40D781A9CBE25E215D28D82",
    "process_id": 16209,
    "process_name": "/System/Library/PreferencePanes/Accounts.prefPane/Contents/XPCServices/com.apple.preferences.users.remoteservice.xpc/Contents/MacOS/com.apple.preferences.users.remoteservice",
    "session_id": 100008,
    "terminal_id": {
      "addr": [
        0
      ],
      "ip_address": "0.0.0.0",
      "port": 33075,
      "type": 0
    },
    "user_id": 502,
    "user_name": "dan"
  },
  "texts": [
    "Removed Groups membership username from '_lpadmin' node '/Local/Default', value = 'presentation'"
  ]
}