The Technology Add-on for macOS Endpoint Logs (TA-macOS) provides index-time and search-time configurations for collecting and normalizing endpoint logs from macOS systems that have the Splunk Universal Forwarder installed. It focuses on native macOS logs, specifically `/var/log/system.log` and `/var/log/install.log`, and turns them into analytics-ready data for security and operations use cases. This add-on defines consistent sourcetypes, handles multiline events correctly, extracts core fields, and provides CIM-friendly eventtypes and tags that support Splunk Enterprise Security data models such as Authentication, Change, and Endpoint.