Gatekeeper events quering from unified logs

gatekeeper_events.sh

#!/usr/bin/env bash
# doesn't requires private data on
log show --style syslog --predicate 'process == "taskgated" && eventMessage CONTAINS[c] "no system signature"' --info --debug --last 1d
log show --style syslog --predicate 'eventMessage CONTAINS[c] "MalwareFileNameFullOrPart"' --info --debug --last 1d
log show --style syslog --predicate 'process == "kernel" && eventMessage CONTAINS[c] "Security policy would not allow process"' --info --debug --last 1d


# requires private data on
log show --style syslog --predicate 'process == "CoreServicesUIAgent" && eventMessage CONTAINS[c] "bundle="' --info --debug --last 1d
log show --style syslog --predicate 'subsystem == "com.apple.launchservices" && category == "code-evaluation"' --info --debug --last 1d
log show --style syslog --predicate 'process == "syspolicyd" && eventMessage CONTAINS[c] "Gatekeeper assessment"' --info --debug --last 1d
#shows only paths
log show --style syslog --predicate 'process == "syspolicyd" && eventMessage MATCHES "(GK process|Gatekeeper) assessment.*"' --info --debug --last 1d | perl -ne '/(?:ment|at): (.+?)(?: <--.*|$)/;$1 and print $1,"\n";' | sort | uniq

Need to enable unified log private data using profile from here https://georgegarside.com/blog/macos/sierra-console-private/