Possible to watch background process activation? (Example: Ostiarius)

[JayBrown]

I'm using the Ostiarius background process by Objective-See to block the execution of unsigned apps/binaries, and the system.log entries look like this:
27/04/16 15:07:03,000 kernel[0]: OSTIARIUS: /Applications/APP_NAME.app/Contents/MacOS/APP_BINARYNAME is from the internet & is unsigned -> BLOCKING!
Is there a way to monitor this? I tried adding "OSTIARIUS:" into the settings file, but that didn't do the trick.

[JayBrown]

Just saw the parsers directory; so the settings.py file would have this line:
'/var/log/system.log': ('sudo', 'ssh', 'portscan', 'ostiarius'),
…while there's an additional file ostiarius.py in /parsers, or am I wrong?

[pirate]

#18

[pirate]

Download the release with the new Ostiarius parser here: https://github.com/pirate/security-growler/releases/tag/v2.2