Skip to content

Commit f6efbf3

Browse files
nubtronnubtron
authored
Reapply Mac Audit Logs (#19989) after fixing the dependency (#20554)
* Reapply "[AI-5153] DDS: Mac Audit Logs Integration v1.0.0 (#19989)" (#20535) This reverts commit a065a24. * Fix dependency (move it to optional dependencies, pin it, and set it to the same version the agent is using)
1 parent a15dacb commit f6efbf3

35 files changed

+6490
-0
lines changed

‎.codecov.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,10 @@ coverage:
410410
target: 75
411411
flags:
412412
- litellm
413+
Mac_Audit_Logs:
414+
target: 75
415+
flags:
416+
- mac_audit_logs
413417
MapR:
414418
target: 75
415419
flags:
@@ -1314,6 +1318,11 @@ flags:
13141318
paths:
13151319
- litellm/datadog_checks/litellm
13161320
- litellm/tests
1321+
mac_audit_logs:
1322+
carryforward: true
1323+
paths:
1324+
- mac_audit_logs/datadog_checks/mac_audit_logs
1325+
- mac_audit_logs/tests
13171326
mapr:
13181327
carryforward: true
13191328
paths:

‎.github/CODEOWNERS

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -538,6 +538,11 @@ plaid/assets/logs/ @DataDog/saa
538538
/forcepoint_security_service_edge/manifest.json @DataDog/saas-integrations @DataDog/documentation
539539
/forcepoint_security_service_edge/assets/logs/ @DataDog/saas-integrations @DataDog/documentation @DataDog/logs-backend
540540

541+
/mac_audit_logs/ @DataDog/agent-integrations
542+
/mac_audit_logs/*.md @DataDog/agent-integrations @DataDog/documentation
543+
/mac_audit_logs/manifest.json @DataDog/agent-integrations @DataDog/documentation
544+
/mac_audit_logs/assets/logs/ @DataDog/agent-integrations @DataDog/documentation @DataDog/logs-backend
545+
541546
/gpu/ @DataDog/ebpf-platform
542547
/gpu/*.md @DataDog/ebpf-platform @DataDog/documentation
543548
/gpu/manifest.json @DataDog/ebpf-platform @DataDog/agent-integrations @DataDog/documentation

‎.github/workflows/config/labeler.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -395,6 +395,8 @@ integration/linux_proc_extras:
395395
- linux_proc_extras/**/*
396396
integration/litellm:
397397
- litellm/**/*
398+
integration/mac_audit_logs:
399+
- mac_audit_logs/**/*
398400
integration/mailchimp:
399401
- mailchimp/**/*
400402
integration/mapr:

‎.github/workflows/test-all.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2494,6 +2494,26 @@ jobs:
24942494
minimum-base-package: ${{ inputs.minimum-base-package }}
24952495
pytest-args: ${{ inputs.pytest-args }}
24962496
secrets: inherit
2497+
jc1b3d1e:
2498+
uses: ./.github/workflows/test-target.yml
2499+
with:
2500+
job-name: Mac Audit Logs
2501+
target: mac_audit_logs
2502+
platform: linux
2503+
runner: '["ubuntu-22.04"]'
2504+
repo: "${{ inputs.repo }}"
2505+
python-version: "${{ inputs.python-version }}"
2506+
standard: ${{ inputs.standard }}
2507+
latest: ${{ inputs.latest }}
2508+
agent-image: "${{ inputs.agent-image }}"
2509+
agent-image-py2: "${{ inputs.agent-image-py2 }}"
2510+
agent-image-windows: "${{ inputs.agent-image-windows }}"
2511+
agent-image-windows-py2: "${{ inputs.agent-image-windows-py2 }}"
2512+
test-py2: ${{ inputs.test-py2 }}
2513+
test-py3: ${{ inputs.test-py3 }}
2514+
minimum-base-package: ${{ inputs.minimum-base-package }}
2515+
pytest-args: ${{ inputs.pytest-args }}
2516+
secrets: inherit
24972517
ja15251c:
24982518
uses: ./.github/workflows/test-target.yml
24992519
with:

‎mac_audit_logs/CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# CHANGELOG - mac_audit_logs
2+
3+
<!-- towncrier release notes start -->
4+

‎mac_audit_logs/README.md

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
## Overview
2+
3+
[Mac Audit Logs][1] captures detailed information about system events, user actions, network and security-related activities. These logs are crucial for monitoring system integrity, identifying unauthorized access, and ensuring adherence to security policies and regulations.
4+
5+
This integration provides enrichment and visualization for various log types, including:
6+
7+
- **Authentication and Authorization** events
8+
- **Administrative** activities
9+
- **Network** events
10+
- **File Access** activities
11+
- **Input/Output Control**
12+
- **IPC (Inter-Process Communication)**
13+
14+
This integration collects Mac audit logs and sends them to Datadog for analysis, providing visual insights through out-of-the-box dashboards and the Log Explorer. It also helps monitor and respond to security threats with ready-to-use Cloud SIEM detection rules.
15+
16+
* [Log Explorer][2]
17+
* [Cloud SIEM][3]
18+
19+
## Setup
20+
21+
### Installation
22+
23+
To install the Mac Audit Logs integration, run the following Agent installation command and follow the steps below. For more information, see the [Integration Management][4] documentation.
24+
25+
For Mac, run:
26+
```shell
27+
sudo datadog-agent integration install datadog-mac-audit-logs==1.0.0
28+
```
29+
30+
31+
### Configuration
32+
33+
#### Configure BSM Auditing on Mac
34+
**Note**: The following steps are required for the Mac version >=14.
35+
36+
1. Copy the configurations from `audit_control.example` to `audit_control`
37+
```shell
38+
cp /etc/security/audit_control.example /etc/security/audit_control
39+
```
40+
41+
2. Update the configuration to specify the event types that should be audited. Execute the command below to audit all event types:
42+
```shell
43+
sudo sed -i '' 's/^flags:.*/flags:all/' /etc/security/audit_control && \
44+
sudo sed -i '' 's/^naflags:.*/naflags:all/' /etc/security/audit_control
45+
```
46+
3. Restart `auditd` service:
47+
```shell
48+
/bin/launchctl enable system/com.apple.auditd
49+
```
50+
51+
4. Restart the Mac.
52+
53+
### Validation
54+
55+
[Run the Agent's status subcommand][5] and look for `mac_audit_logs` under the Checks section.
56+
57+
## Data Collected
58+
59+
### Metrics
60+
61+
The Mac Audit Logs integration does not include any metrics.
62+
63+
### Log Collection
64+
65+
1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file:
66+
67+
```yaml
68+
logs_enabled: true
69+
```
70+
71+
2. Configure `mac_audit_logs.d/conf.yaml` file to start collecting Mac audit logs.
72+
73+
See the [sample mac_audit_logs.d/conf.yaml][6] for available configuration options.
74+
75+
```yaml
76+
init_config:
77+
instances:
78+
- MONITOR: true
79+
AUDIT_LOGS_DIR_PATH: /var/audit
80+
min_collection_interval: 15
81+
logs:
82+
- type: integration
83+
service: mac-audit-logs
84+
source: mac-audit-logs
85+
```
86+
87+
**Note**:
88+
- Do not change the `service` and `source` values, as they are essential for proper log pipeline processing.
89+
- Default value for `AUDIT_LOGS_DIR_PATH` is `/var/audit`. In case of different BSM audit logging directory, please check `dir` value in `/etc/security/audit_control` file.
90+
91+
3. [Restart the Agent][7].
92+
93+
### Events
94+
95+
The Mac Audit Logs integration does not include any events.
96+
97+
## Troubleshooting
98+
99+
Need help? Contact [Datadog support][8].
100+
101+
102+
[1]: https://www.apple.com/mac/
103+
[2]: https://docs.datadoghq.com/logs/explorer/
104+
[3]: https://www.datadoghq.com/product/cloud-siem/
105+
[4]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install
106+
[5]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
107+
[6]: https://github.com/DataDog/integrations-core/blob/master/mac_audit_logs/datadog_checks/mac_audit_logs/data/conf.yaml.example
108+
[7]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
109+
[8]: https://docs.datadoghq.com/help/

‎mac_audit_logs/assets/configuration/spec.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Mac Audit Logs
2+
files:
3+
- name: mac_audit_logs.yaml
4+
options:
5+
- template: init_config
6+
options:
7+
- template: init_config/default
8+
- template: instances
9+
options:
10+
- name: MONITOR
11+
required: true
12+
description: "Flag indicating Mac audit log collection status. Set to true to enable collection."
13+
value:
14+
type: boolean
15+
example: true
16+
- name: AUDIT_LOGS_DIR_PATH
17+
required: true
18+
description: "Path to the directory containing the BSM audit logs."
19+
value:
20+
type: string
21+
example: /var/audit
22+
- template: instances/default
23+
overrides:
24+
min_collection_interval.required: true
25+
min_collection_interval.value.example: 15
26+
min_collection_interval.value.minimum: 1
27+
min_collection_interval.value.maximum: 64800
28+
service.hidden: true
29+
empty_default_hostname.hidden: true
30+
metric_patterns.hidden: true
31+
- template: logs
32+
example:
33+
- type: integration
34+
service: mac-audit-logs
35+
source: mac-audit-logs

0 commit comments

Comments
 (0)