macos:openbsm class:lo
login and logout
- Log source
- OpenBSM audit trail (deprecated by Apple)
- Host type
- macOS
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
DISA STIG (macos)
By role
| Role | Tier | Basis |
|---|---|---|
| macOS endpoint | Recommended | DISA STIG (macos) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Audit flags (OpenBSM)Apple macOS 15 (Sequoia) V1R8 (2026-10-05) | Names this event | APPL-15-001002 (macos): audit flag lo |