macos:endpoint
macOS endpoint
User endpoints on macOS.
- Host type
- macOS
- Standards scope
- macos
- Minimum events
- 1
- Recommended events
- 36
- Log sources
- 10
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | Recommended | 0 | 811 |
| Elastic Defend endpoint events | Recommended | 0 | 1,081 |
| Microsoft Defender for Endpoint device tables | Recommended | 0 | 379 |
| SentinelOne Singularity telemetry | Recommended | 0 | 459 |
Minimum
1 events meet the minimum bar for this role: an ATT&CK analytic names each one, and either a standard in the role's scope requires it or at least the platform's threshold of vendor rules depends on it. Grouped by log source; the source heading carries the cost class.
macOS Endpoint Security framework events1 event · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| ES_EVENT_TYPE_NOTIFY_EXEC | 17 | Sigma 70 |
Recommended
36 more events meet one of the three criteria. Each source opens on its own.
macOS Endpoint Security framework events11 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| es_event_authentication | 1 | none | ||
| es_event_exec | 2 | none | ||
| ES_EVENT_MMAP | 1 | none | ||
| es_event_open | 1 | none | ||
| ES_EVENT_TYPE_NOTIFY_CONNECT | 1 | none | ||
| ES_EVENT_TYPE_NOTIFY_KEXTLOAD | 1 | none | ||
| ES_EVENT_TYPE_NOTIFY_MMAP | 3 | none | ||
| ES_EVENT_TYPE_NOTIFY_OPEN | 1 | none | ||
| exec | 2 | none | ||
| rename | 1 | none | ||
| write | 1 | none |
OpenBSM audit trail (deprecated by Apple)8 events
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| class:aaauthentication and authorization | 0 | none | STIG | |
| class:adadministrative actions | 0 | none | STIG | |
| class:ex (failure)program execution | 0 | none | STIG | |
| class:fd (failure)file deletion | 0 | none | STIG | |
| class:fmfile attribute modification | 0 | none | STIG | |
| class:fr (failure)file read | 0 | none | STIG | |
| class:fw (failure)file write | 0 | none | STIG | |
| class:lologin and logout | 0 | none | STIG |
osquery (macOS)17 events · Free tool
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| code_signing | 1 | none | ||
| exec | 2 | none | ||
| execve | 2 | none | ||
| file_events | 12 | none | ||
| file_metadata | 2 | none | ||
| interface_details | 1 | none | ||
| launch_daemons | 1 | none | ||
| launchd | 2 | none | ||
| launchd_jobs | 1 | none | ||
| mach_o_info | 1 | none | ||
| process_events | 25 | none | ||
| process_events/socket_events | 1 | none | ||
| process_open | 1 | none | ||
| processes | 1 | none | ||
| socket_events | 10 | none | ||
| usb_devices | 1 | none | ||
| write | 1 | none |
The EDR path
Sensor events an EDR product emits for this role. They are an alternative way to collect what an OS event carries, and each inherits its ATT&CK standing from the OS event it fully stands in for. The counts above are for the OS path.
Log sources on this role
- CrowdStrike Falcon sensor telemetry (FDR event_simpleName)
- Elastic Defend endpoint events
- Microsoft Defender for Endpoint device tables
- Other EDR telemetry (Endgame, Carbon Black, product not stated)
- SentinelOne Singularity telemetry
- macOS Endpoint Security framework events
- OpenBSM audit trail (deprecated by Apple)
- osquery (macOS)
- Other macOS sources (fsevents, plists, launchd, TCC, MDM)
- macOS unified log