Forum Discussion
Solved
Mac OS Logs
With no Agent readily available for Mac OS devices has anyone been able to onboard any logs into Azure Sentinel by Syslog or any other method?
arran1580 If you're using Intune (Endpoint Manager) to manage the Mac devices, you can do the following and then setup custom log ingestion into the Log Analytics workspace for Sentinel.
https://docs.microsoft.com/en-us/mem/intune/apps/macos-shell-scripts#collect-device-logs
You will still need to do some post-ingestion parsing, though.
Rod_Trent
Microsoft
Microsoftarran1580 If you're using Intune (Endpoint Manager) to manage the Mac devices, you can do the following and then setup custom log ingestion into the Log Analytics workspace for Sentinel.
https://docs.microsoft.com/en-us/mem/intune/apps/macos-shell-scripts#collect-device-logs
You will still need to do some post-ingestion parsing, though.
