Relay v0.1.0

Relay 0.1.0 - 2026-10-21

Changes

• First release. Takes SAP Privileges' webhook and forwards each change to Splunk, Microsoft
  Sentinel, syslog or stdout as the same OCSF records the Altiward server emits.
• Stores every event on disk before answering, so an event Privileges has handed over survives
  a SIEM outage or a restart of the relay.
• Requires each Mac's client certificate, either itself or through a proxy's
  X-Forwarded-Client-Cert header.

Hook hook-v0.1.0

Hook 0.1.0 - 2026-10-21

Changes

• First release. Runs as SAP Privileges' post-change executable and sends each change straight
  from the Mac to Splunk, Microsoft Sentinel or an HTTPS webhook, as the same OCSF records the
  Altiward server emits.
• Reports the user's real admin membership, not what it was told, and only when it changes.
• Queues events it can't send and resends them every 5 minutes.
• Installs as Altiward Forwarder, the name macOS and Privileges show, with a profile that makes
  its background item managed, and a TrustedCAs setting for destinations with private
  certificates.