[New Integration] macOS Security Events

Description

We support custom macOS unified logging, but users want a native Elastic integration that collects only security-relevant macOS telemetry.
Users experience excessive amounts of logs from the custom macOS Unified Logs integration, sometimes generating equivalent log volume to thousands of Windows hosts. Teams need filtered, security-focused event collection similar to how they monitor Windows, focusing on user activities, privilege changes and system modifications.

Instead of seeing relevant security events, users are overwhelmed with noise:

Mouse clicked at coordinates 245,156
Screen brightness changed to 75%
User logged in successfully  
Network packet received
Sudo command executed

When they want security-focused output:

User logged in successfully
Sudo command executed

Customer context

"I'm only interested in logs similar to the ones that I can get from Windows and Linux, like creation of local users, sudo usage etc."

"Authentication, Process Execution, Network Connections, File Reads and Writes, System Changes. Would be nice to add some advanced things as well like monitoring plist / ssh keys / system startup / listening processes."

Core security event categories

Implement preset filters for:

Authentication

Sudo usage and privilege escalation
Authentication failures/successes
SSH access attempts

User & account management

Local user creation/deletion
Admin privilege grants/removals

Process execution monitoring

Process creation/termination events
Unsigned/untrusted application execution

Network activity

Network connection establishment/termination
Listening service changes

File reads/writes

Sensitive system file access
Quarantine attribute changes on downloaded files

System changes

System policy modifications
Software installation/removal

Advanced monitoring needs:

Property list (plist) modifications
SSH key monitoring
System startup events
Listening processes/services
Enhanced process monitoring beyond basic Auditbeat

Implementation

Ingest fault, error, and default log levels
Exclude info and debug to reduce volume
Extract structured fields from composedMessage (process names, file paths, network endpoints, user info)
Filter example (user login events):
log show --predicate 'process contains "loginwindow" and composedMessage contains "com.apple.sessionDidLogin"'
For a full list of available keys: Run log help predicates

I think that a good aproach would be to group those preset filters in these categories and make an option to enable/disable some categories.

For example, we want Authentication, User & account management and System Changes, but Network activity and File reads/writes may not be required as they are collected by other tools, so being able to enable/disable specifica categories would be nice.

@leandrojmp

Hey @leandrojmp thanks for the suggestion. Taking inspiration from Elastic Defend is this more or less what you'd be envisioning, checkboxes to toggle the different categories on/off?

@cpascale43

Hello @cpascale43 ,

Yeah, it was something like this, but I think that on Elastic Agent side is more common to have on/off toggles, like these ones in the Google Workspace integration:

@cpascale43

Hi @cpascale43

Among the following categories, we were able to find logs for all:

Authentication
User & Account Management
Process Execution Monitoring
Network Activity
File Reads/Writes
System Changes
Advanced Monitoring Needs

That said, even within the categories where logs are available, there are still a few event types we have not been able to identify yet.

So far, we have applied predicates that we assumed were correct, based on references found online (e.g., ChatGPT, Stack Overflow, etc.).
We are unable to find any official documentation available that outlines the correct predicates for these categories.
Attached below is the document containing the predicates we have applied so far along with one log for each category found.
Predicates and Logs

Query:
We’ve noticed that the eventMessage contains multiple message formats for each sub-category. However, with the predicates we’ve listed in the above document, we aren’t able to fetch any specific fields like processName or fileName inside the eventMessage. So far, we’re only able to see following fields (highlighted in below logs):

User & Account Management
-[SessionLogoutManager buildSessionDictionary] | final sessionDictionary:{ DirectLogoutType = 5; GroupID = 248; GuestAccount = 0; HomeDirectoryPath = "/var/setup"; SessionAgentPID = 100; UserGUID = "FFFFEEEE-DDDD-CCCC-BBBB-AAAA000000F8"; UserID = 248; UserLongName = "Setup User"; UserName = "_mbsetupuser"; }
Network Activity
Duration: 0.598s, DNS @0.000s took 0.262s, TCP @0.266s took 0.040s, TLS 1.3 took 0.904s\n\tbytes in/out: 23282/851, packets in/out: 7/10, rtt: 0.032s, retransmitted bytes: 0, out-of-order bytes: 0\n\tecn packets sent/acked/marked/lost: 3/3/0/0
File Reads/Writes
\n NSFileCreationDate = "2025-09-26 06:29:53 +0000";\n NSFileExtendedAttributes = {\n "com.apple.quarantine" = {length = 29, bytes = 0x30303836 3b303030 30303030 303b636f ... 6c652e67 656f643b };\n };\n NSFileExtensionHidden = 0;\n NSFileGroupOwnerAccountID = 205;\n NSFileGroupOwnerAccountName = "_locationd";\n NSFileModificationDate = "2025-09-26 06:34:50 +0000";\n NSFileOwnerAccountID = 205;\n NSFileOwnerAccountName = "_locationd";\n NSFilePosixPermissions = 493;\n NSFileProtectionKey = NSFileProtectionCompleteUntilFirstUserAuthentication;\n NSFileReferenceCount = 5;\n NSFileSize = 160;\n NSFileSystemFileNumber = 19712;\n NSFileSystemNumber = 16777220;\n NSFileType = NSFileTypeDirectory;\n

Feel free to suggest additional predicates that would allow us to extract fields such as process details or filenames.

@leandrojmp

@leandrojmp , @cpascale43
We explored the option of having on/off toggles on the Elastic Agent side,
but it isn’t feasible to support this functionality.

The reason is that the predicate field in the unified_log input type only supports a list type.
To implement an on/off toggle, we would need to use an if-else condition like the one below —

However, this results in the following error.

I just found this: https://github.com/mandiant/macos-UnifiedLogs

Perhaps it would help

I see the OTel has also a stalled parser for this
open-telemetry/opentelemetry-collector-contrib#41845

@zez3

Hi @zez3 ,
The links you shared above contain scripts related to macOS unified logs, but they don’t address the issue mentioned earlier — which is about adding on/off toggles to let the user select the categories they want to fetch logs for.

@zez3

@zez3 , Found the toggle issue in the custom Unified log input integration as well. I have raised an issue for the same
Link: elastic/beats#47296

Hello,

Is there any public PR tracking this issue? We want to onboard our Mac workstations on our SIEM, but without any filtering it would generated an insane amount of logs, if there is any public PR we could look at the filters that are being applied and manually apply them on our Agent policy.

@leandrojmp

Thanks @leandrojmp, just DMed you via Community Slack.

Navigation Menu

Repository navigation

[New Integration] macOS Security Events #15444

Description

Customer context