Wayne, where are we at on this? There are still lots of Apple devices out there using their Unified Logging System.

We need security related events, any userid related activity that would help our Interset/Arcsight Intelligence find bad behaviour. Anything that would track abnormal activity of the user or the endpoint itself. The unified logiing is across the entire Apple platform and has lots of IOT pieces.

Wayne,

Ideally authentications (logon/logoffs) and file accesses would be the first types of events that can be parsed.

Hi Idea Contributors,

We are evaluating support for Apple Unified Logging and would like to ask all of you who have voted for this enhancement to help us with potentially fulfilling it. 

One of our challenges is to better understand which events generated by these Apple devices actually should be parsed for relevant security information. This would help us evaluate the scope of what this enhancement would entail.

We would be grateful if someone can help with determining the specific events that should be parsed.

Thanks,

Wayne Dalesio

ArcSight Product Management