macOS Unified Logs Integration #24

What the feature is: Native macOS Security Events Integration

Value proposition: Provides security teams with filtered, actionable macOS telemetry focused exclusively on security-relevant events (authentication, privilege escalation, process execution, file changes, network activity) without the overwhelming volume of operational noise generated by the full unified logging system.

Expected outcome: Users receive only security-focused events similar to Windows/Linux monitoring capabilities. Log volume reduced by ~90%+ compared to custom macOS Unified Logs integration

Key user stories / use cases: As a SOC analyst, I want to monitor macOS authentication events (logins, sudo usage, SSH access) without seeing every mouse click and brightness change