topic Re: Mac OS high sierra USB monitoring in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423236#M5309 <P>I know that osquery is capable of USB device monitoring and there are a couple of Splunk apps dedicated to osquery monitoring.</P> <UL> <LI><A href="https://splunkbase.splunk.com/app/3902/">https://splunkbase.splunk.com/app/3902/</A></LI> <LI><A href="https://splunkbase.splunk.com/app/3278/">https://splunkbase.splunk.com/app/3278/</A></LI> </UL> <P>This would mean installing the osquery client on the endpoints but Macs are supported.</P> Sat, 07 Jul 2018 17:55:15 GMT LukeMurphey 2018-07-07T17:55:15Z Mac OS high sierra USB monitoring https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423235#M5308 <P>Is there a way to Monitor USB activity for all Mac books and systems on an enterprise level? For example maybe use logs to grab the device ID of a USB and forward it to Splunk where Splunk can alert you of such activity.</P> Fri, 06 Jul 2018 21:33:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423235#M5308 johns0n1216 2018-07-06T21:33:42Z Re: Mac OS high sierra USB monitoring https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423236#M5309 <P>I know that osquery is capable of USB device monitoring and there are a couple of Splunk apps dedicated to osquery monitoring.</P> <UL> <LI><A href="https://splunkbase.splunk.com/app/3902/">https://splunkbase.splunk.com/app/3902/</A></LI> <LI><A href="https://splunkbase.splunk.com/app/3278/">https://splunkbase.splunk.com/app/3278/</A></LI> </UL> <P>This would mean installing the osquery client on the endpoints but Macs are supported.</P> Sat, 07 Jul 2018 17:55:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423236#M5309 LukeMurphey 2018-07-07T17:55:15Z Re: Mac OS high sierra USB monitoring https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423237#M5310 <P>Do you have any documentation for installing these add ons they don't have much info on their page. </P> Wed, 11 Jul 2018 15:47:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Mac-OS-high-sierra-USB-monitoring/m-p/423237#M5310 johns0n1216 2018-07-11T15:47:14Z