Splunk Enterprise Security

Mac OS high sierra USB monitoring

New Member

Is there a way to Monitor USB activity for all Mac books and systems on an enterprise level? For example maybe use logs to grab the device ID of a USB and forward it to Splunk where Splunk can alert you of such activity.

0 Karma

Champion

I know that osquery is capable of USB device monitoring and there are a couple of Splunk apps dedicated to osquery monitoring.

This would mean installing the osquery client on the endpoints but Macs are supported.

0 Karma

New Member

Do you have any documentation for installing these add ons they don't have much info on their page.

0 Karma