Common Information Model - Monitoring macOS

Map Macs to the Splunk Common Information Model for Splunk Enterprise Security: SSH, sudo and console logins, security setting, account, launch item and application changes, launchd services, listening ports, network traffic and pending updates.

Make your Macs show up in Splunk Enterprise Security, or any search built on the Splunk Common Information Model (CIM), as your other endpoints do. The Monitoring macOS app maps the events Collectord already forwards to the CIM data models, with eventtypes, tags and search-time fields.

The mapping shows:

who signed in over SSH or at the console, and who ran sudo;
which security settings and accounts changed;
what was set to start at login;
which services run and which ports listen;
where the Macs connect;
which updates are pending.

Nothing changes at collection, so the mapping adds nothing to your Splunk license. The only cost is the data model acceleration you turn on.

What maps where

Data model	From	Eventtype
Authentication	SSH logins accepted and refused, from the `security` log pack	`macos_ssh_authentication`
Authentication (privileged)	sudo commands run and refused, from the `security` log pack	`macos_sudo`
Authentication	a login at the console	`macos_login`
Change: Endpoint_Changes	a security setting changed: FileVault, SIP, Gatekeeper, the firewall, remote access, …	`macos_posture_change`
Change: Account_Management	a local account created or deleted, or given or stripped of administrator rights	`macos_account_change`, and `macos_account_delete` for a deletion
Change: Endpoint_Changes	a launch daemon or agent added, removed or changed	`macos_launch_item_change`
Change: Endpoint_Changes	a login item, or an agent or daemon an app registers from its bundle, added, removed or changed	`macos_background_item_change`
Change: Endpoint_Changes	an application installed, updated or removed	`macos_app_change`
Endpoint: Services	a launchd service started, exited or restarted	`macos_launchd_service`
Endpoint: Ports	a socket listening for connections	`macos_listening_port`
Network_Traffic	a process’s connections to one remote address and port	`macos_network_traffic`
Updates	the software updates macOS lists as pending	`macos_updates_pending`

The Performance and Compute_Inventory models are not mapped: a Mac sends its stats to a metrics index only, and data models search events.

Set up the CIM

Install the Splunk Common Information Model add-on (Splunk_SA_CIM) on your search heads. Splunk Enterprise Security ships with it.
Point the add-on’s index macros for the models you use at the events index Collectord sends to: cim_Authentication_indexes, cim_Change_indexes, cim_Endpoint_indexes, cim_Network_Traffic_indexes and cim_Updates_indexes. List the same indexes as the app’s macro_macos_base macro, for example (index=macos).
Keep the inputs the models read turned on. All of them are on by default:
- the security log pack, for SSH and sudo;
- [input.macos_events], with [input.macos_status] users, posture, accounts, launchItems, backgroundItems, launchd and updates, for console logins, changes, services and updates;
- [input.macos_apps], for applications;
- [input.macos_connections], for ports and network traffic.

To check the mapping, count the Macs’ authentications through the data model:

text

1| tstats count from datamodel=Authentication by Authentication.app, Authentication.action, Authentication.dest

Authentication

dest is the Mac and vendor_product is Apple macOS.

SSH. Each of sshd’s authentication lines is one event: accepted (action success) or refused (failure). The event has the user, the source address as src, and the method in signature and authentication_method. A line is not one attempt. A wrong password logs a Failed line and, when the client gives up, a closing line; a key an account refuses logs only the closing line.
sudo. Each command run or refused maps to Privileged_Authentication, with the user who ran sudo as src_user and the target user as user. On macOS 15 and later, sudo logs only its refusals unless you turn its log_allowed option back on (see Log forwarding).
Console logins. A login at the Mac’s login window, with app loginwindow. A login over SSH is sshd’s own line above, and a terminal authenticates no one.

The security pack reads sudo, sshd-session and sshd by their paths, so a program a user names sudo or sshd cannot pass its lines off as theirs. An sshd line with an = in it (a user name whose key=value text Splunk would read as fields) is not mapped.

On an SSH or sudo line the mapping takes, every other Authentication field is cleared, so a sudo command’s key=value text supplies none. Splunk Enterprise Security’s asset and identity lookups still fill theirs.

Changes

dest and dvc are the Mac, status is success, and action is created, deleted or modified. The other fields:

object names what changed: the setting, the account, the launch item’s label, the background item’s identifier, the application.
object_category comes with it, and object_path where there is one.
change_type is security setting, AAA for an account, persistence for a launch or background item, or application.
A security setting’s result is its old and new value, such as 1 -> 0.

A deleted account is also tagged delete, which Splunk Enterprise Security’s Access - Account Deleted rule reads. The applications’ periodic snapshot is no change and stays out.

A background item’s change is what macOS’s Login Items & Extensions list says, and a local user can add entries of their own to that list. Treat one a user could have written as that user’s claim.

Services, ports and network traffic

Services. Every launchd service Collectord reports one by one: every service not labelled com.apple.*, unless launchd.include and launchd.exclude say otherwise. service is the label. status is started (a restart too), stopped on a clean exit, or critical on a non-zero one.
Ports. Each listening socket, with dest_port, transport and the application as process_name. The event sent when a socket closes stays out.
Network_Traffic. Each group of a process’s connections to one remote address and port. It has src, dest, dest_port, transport and direction; the application as process_name (for a helper, the app it works for); and bytes_in, bytes_out and bytes. action is allowed once a connection completed.

Pending updates

Every update check sends the updates macOS lists as pending. The event maps to Updates, so Enterprise Security’s Update Center lists them. Each update’s name is in signature and signature_id, status is available, and the Mac is dest.