Hi all,
How do you collect your macOS security logs and index them into your Splunk Cloud/Enterprise instance?
I already have a deployment server so it would be great to just install the UF's with some parameters to connect to the DS and from there on install the app & make the UF send what the app tells it to send.
Is the best way to do it using the Splunk UF?
Apple changed to the Unified Log Database format, so how do you do it?
My manager suggested SC4S but is it necessary? Can SC4S even ingest macOS data?
We want the SC4S server to remain internal since all of us are WFH. SC4S is not recommended to be used with wireless networks/firewalls/or IDS's which we all have. So I don't think that's possible.
I would greatly appreciate your help.
