Monitoring event logs on macOS
Learn about and configure event log monitoring for Mac
Overview
The RocketCyber Suspicious Event Log Monitor app is designed to collect desired log data from the Unified Event Log found in modern versions of macOS.
Configuration
- From the dashboard in the Provider, Organization, or a Device context, click the Configure button on the Suspicious Event Monitor app card
- This displays the app's configuration options. Next click on macOS
- Here you can choose which events should be monitored and other configuration items. By default the agent will check for matching events every 5 minutes (300 seconds), this can be adjusted either up or down to the desired interval.
Log Privacy
One of the key goals of the redesign of the macOS logging system to Unified Logging was to create a level of privacy so that potentially sensitive information such as IP addresses, user names, etc would be redacted from the general log view. As shown in the example below, the username is redacted and replaced with the tag <private>
Authentication failed for <private> with ODErrorCredentialsInvalid
By default, logs are set to private mode, and this information is stripped or redacted. This presents a challenge from the security standpoint when this data is required to perform investigations etc. Luckily there is the capability to turn this feature off.
By default, the Event Log Monitor runs in privacy mode, meaning that potentially sensitive information will be masked or redacted in the logs. By switching the Log Privacy option to off this will configure the logs to record the potentially sensitive information and allow more robust investigations.
NOTE Turning off Log privacy will only affect log entries going forward, entries that were recorded in the past with privacy turned on will remain private.
Custom Events
There is a default set of events that are defined that provide meaningful security incident alerts. Should you find the need to include additional log data you can add a Custom Event type by:
Click on Add a Custom Event.
The required fields for a custom event are displayed above.
- Event ID - This is an identifier of your choice that will allow you to quickly recognize the events in reports and triage. They can be alpha or numeric but not contain spaces.
- Filter - This is the search filter for the log file in predicate syntax. Example:
subsystem = "com.apple.opendirectoryd"
The filter above will return all events for the opendirectoryd service
- Description - This is a textual description of the event such as Failed authentication.
For more information on building predicate filters and syntax options see:
