Window app
Your Mac keeps a detailed audit trail.
Now you can read it.
| Severity | Finding | ATT&CK | Time |
|---|---|---|---|
| Critical | Successful SSH login after 212 failures from 203.0.113.44 | T1110 | 02:14:07 |
| Critical | Backdoor admin account “support” created | T1136.001 | 02:21:40 |
| High | LaunchDaemon written: com.apple.updated.plist | T1543.004 | 02:19:12 |
| High | Base64-encoded payload executed from /tmp | T1059.004 | 02:18:55 |
| Medium | Audit log configuration modified | T1562.012 | 02:30:03 |
AuditScope parses OpenBSM trails in pure Swift, about 520,000 records in 1.7 seconds, and turns them into views you can actually investigate.
Record, failure and finding counts, an activity histogram you can drill into, and the top events, processes and users.
A sortable table of every record with search and filters. The inspector decodes every token and shows a hex dump.
A process tree rebuilt from fork, exec and exit, with command lines, signing IDs and suspicious locations highlighted.
About 40 detection rules mapped to MITRE ATT&CK: brute force, persistence, Gatekeeper and SIP tampering, credential access, and more.
Streams /dev/auditpipe with your own class selection and runs detections as records arrive.
Keeps capturing from the menu bar and sends a notification for every new High or Critical finding.
Recent macOS versions ship with auditing off. Audit Setup checks your Mac and generates the configuration for you.
AuditScope runs unprivileged. Reading /var/audit or starting a live capture asks for an administrator password each time, and nothing is installed or left running.
praudit -xr on every record of the sample. Corrupt regions are resynchronised.auditreduce.AuditScope.zip · 3.2 MB
Universal app for macOS 14 and later. Open it with the sample incident to explore before you enable auditing.
Download · 3.2 MB