Macbook capture Events and Logs

Question

​Greetings, Jamf Community.I'm looking for guidance on how to efficiently capture and correlate logs and events from a MacBook device. Specifically, I want to track user login events, device reboots, and open applications, for example, "Chrome." Can anyone recommend whether Jamf may be able to achieve this? Thank you.

AJPinto · Accepted Answer

You are looking for something called SIEM log redirection. There are not a ton of tools that do this for macOS, but a few do exist. Jamf Protect can perform this function with its Compliance Reporting feature. With Protect, you can either let it automatically redirect logs to a SIEM like Splunk, or you and write Custom Analytic Sets and host the event logs directly in Jamf Protect. Splunk also provides a macOS agent that can redirect console logs to SIEM (being Splunk in this case).

Jamf launches Compliance Reporter

Compliance Reporter Overview - Compliance Reporter Documentation | Jamf

Collect Mac OS X metrics and logs with Splunk App for Infrastructure - Splunk Documentation

Greetings, AJPinto.

I will be investing more in Splunk and I appreciate you sharing this information.

Thank you.