Getting Data In

MacOS Security Logging?



Looking to bring in general security data from about 200 MacOS laptops. Ideally CIM friendly and filtered down all the junk as much as possible.

1) Any good docs/read throughs you'd recommend I start with?
2) I checked out cmdReporter, seems pretty good. Anything else similar I should look at?
3) Is Splunk_TA_nix worth doing on MacOS?


0 Karma

Ultra Champion

Of the back of another answers post this morning, take a look at OSquery.

Looks very lightweight and powerful - playing with it now!

Some of the inputs from TA_nix work on macOS, but recent changes by apple have broken a number of things over the years.
I tend to use my own mac TA which borrows ideas from the TA_nix app - possibly to shortly include osquery too! 🙂

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...