#event_simpleName=ProcessRollup2 event_platform=Mac (ImageFileName=/\/(id|groups)/i OR (ImageFileName=/\/dscl/ AND CommandLine=/list.+users/i))