https://community.splunk.com/t5/Getting-Data-In/MacOS-Security-Logging/m-p/500297#M85243 <P>Of the back of another answers post this morning, take a look at OSquery.<BR /> <A href="https://osquery.io/" target="_blank">https://osquery.io/</A></P> <P>Looks very lightweight and powerful - playing with it now!</P> <P>Some of the inputs from TA_nix work on macOS, but recent changes by apple have broken a number of things over the years.<BR /> I tend to use my own mac TA which borrows ideas from the TA_nix app - possibly to shortly include osquery too! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 30 Sep 2020 03:59:54 GMT nickhills 2020-09-30T03:59:54Z https://community.splunk.com/t5/Getting-Data-In/MacOS-Security-Logging/m-p/500296#M85242 <P>All, </P> <P>Looking to bring in general security data from about 200 MacOS laptops. Ideally CIM friendly and filtered down all the junk as much as possible. </P> <P>1) Any good docs/read throughs you'd recommend I start with? <BR /> 2) I checked out cmdReporter, seems pretty good. Anything else similar I should look at? <BR /> 3) Is Splunk_TA_nix worth doing on MacOS? </P> <P>thanks<BR /> -Daniel </P> Wed, 30 Sep 2020 03:59:40 GMT https://community.splunk.com/t5/Getting-Data-In/MacOS-Security-Logging/m-p/500296#M85242 daniel333 2020-09-30T03:59:40Z https://community.splunk.com/t5/Getting-Data-In/MacOS-Security-Logging/m-p/500297#M85243 <P>Of the back of another answers post this morning, take a look at OSquery.<BR /> <A href="https://osquery.io/" target="_blank">https://osquery.io/</A></P> <P>Looks very lightweight and powerful - playing with it now!</P> <P>Some of the inputs from TA_nix work on macOS, but recent changes by apple have broken a number of things over the years.<BR /> I tend to use my own mac TA which borrows ideas from the TA_nix app - possibly to shortly include osquery too! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 30 Sep 2020 03:59:54 GMT https://community.splunk.com/t5/Getting-Data-In/MacOS-Security-Logging/m-p/500297#M85243 nickhills 2020-09-30T03:59:54Z