Repository navigation
Add macOS support: eslogger, zsh logging, firewall logging, per-OS docs - #5
Merged
Merged
Conversation
macos/install.sh (macOS 13+, system bash 3.2 compatible): - runs Apple's eslogger as a LaunchDaemon writing JSON with newsyslog rotation; event list is intersected with `eslogger --list-events` - logs interactive zsh commands to the unified log via a marked block in /etc/zshrc (restored exactly on revert) - turns on application firewall logging (previous mode restored) - --with-log-archive schedules daily unified-log snapshots - --dry-run, --revert (manifest + backups) and a lab-only confirmation, mirroring the Windows and Linux scripts - detects a missing Full Disk Access grant and prints the exact fix Nothing is downloaded, so there is no offline-prep step on macOS. tests/test-macos.sh and a CI job run install, re-run and revert on macOS 14 and 15; docs/macos.md documents the manual step and limits. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…README - docs/logged-windows.md (moved from what-gets-logged.md), new docs/logged-linux.md and docs/logged-macos.md, each with where to look, retention, limits and what is not yet verified. - docs/what-gets-logged.md is now a side-by-side overview linking to them. - README: macOS quick start, macOS column in the comparison table, per-OS doc links, updated tested matrix, eslogger reference. - THIRD_PARTY.md: note what is bundled per OS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add a scope note to the README and drop the third-party tool suggestions from the macOS page; network capture and other tooling belong in a separate setup stage. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ClaySecAI
added a commit
that referenced
this pull request
Oct 17, 2026
Add macOS support: eslogger, zsh logging, firewall logging, per-OS docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds macOS (13 Ventura or newer) alongside the Windows and Linux scripts.
macos/install.shruns Apple'sesloggeras a LaunchDaemon, writing Endpoint Security events as JSON to/var/log/winlogs/eslogger.ndjsonwithnewsyslogrotation. The event list (exec, file create/unlink/rename, mount, kext load, persistence items, XProtect detections, logins, sudo/su, profile installs, TCC changes, and more) is intersected with whateslogger --list-eventsreports on the host./etc/zshrc; revert restores the file exactly.--with-log-archiveschedules dailylog collectsnapshots (pruned after--keep-days).--dry-run,--revertand a lab-only confirmation, same as the other scripts. Works with the macOS system bash 3.2.what-gets-logged.mdis split intodocs/logged-windows.md,docs/logged-linux.mdanddocs/logged-macos.md, withwhat-gets-logged.mdkept as a side-by-side overview. The macOS page covers the manual Full Disk Access step and the limits.THIRD_PARTY.mdnotes what is bundled per OS.Manual step
esloggerneeds Full Disk Access, which macOS only lets a person or an MDM grant. The installer detects a block and prints the exact fix. Seedocs/logged-macos.md.Testing
tests/test-macos.shruns dry-run, install, re-run and revert and checks the LaunchDaemon, rotation config, zsh hook, firewall mode and that/etc/zshrcis restored byte for byte. CI runs it on macos-14 and macos-15 (Apple silicon) and both pass, andesloggercaptured the test command on both. The CI runners come with permissions pre-granted, so this does not prove a fresh Mac is configured.Not tested: Intel Macs, macOS 13, and a Mac where Full Disk Access has not been granted.
Not included
No Sysmon equivalent and no network connection events (Endpoint Security has no connect event). Network telemetry and other tooling are out of scope for this repo, which the README now states.