09 · Hardening area
Logging & Detection
Prevention fails eventually; visibility decides how fast you notice. Learn to query the Unified Log, what replaced the deprecated OpenBSM audit system, how the Endpoint Security framework feeds EDR tools, and what to forward off the device.
Unified LogEndpoint Securityeslogger
- macOS Logging and Detection: Unified Log and Endpoint Security
Use the macOS unified log, Endpoint Security, eslogger, sysdiagnose, osquery and Santa to gain visibility and detect suspicious activity on Macs.