Splunk and macOS Auditing
To verify that macOS auditing is enabled and functioning correctly, you can use Splunk to search for specific audit logs that macOS generates. macOS uses the OpenBSM audit framework, which…
Ensure Security Auditing Is Enabled
Enable Auditing $ /usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist Read Auditing Setting LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") if [[ $LAUNCHD_RUNNING == 1 ]] &&…
Splunk Status and Locations
Splunk Status settings, Jamf Pro commands