NXLog BSM macOS connector for Microsoft Sentinel

The NXLog BSM macOS data connector uses Sun's Basic Security Module (BSM) Auditing API to read events directly from the kernel for capturing audit events on the macOS platform. This REST API connector can efficiently export macOS audit events to Microsoft Sentinel in real-time.

This is autogenerated content. For changes, contact the solution provider.

Connector attributes

Connector attribute	Description
Log Analytics table(s)	BSMmacOS_CL
Data collection rules support	Not currently supported
Supported by	NXLog

Query samples

Most frequent event types

Kusto

BSMmacOS_CL

| summarize EventCount = count() by EventType_s

| where strlen(EventType_s) > 1

| project Eventype = EventType_s, EventCount

| order by EventCount desc

| render barchart

Most frequent event names

Kusto

BSMmacOS_CL

| summarize EventCount = count() by EventName_s

| project EventCount, EventName = EventName_s

| where strlen(EventName) > 1

| order by EventCount desc

| render barchart

Distribution of (notification) texts

Kusto

BSMmacOS_CL

| summarize EventCount = count() by Text_s

| where strlen(Text_s) > 1

| order by EventCount

| render piechart

Vendor installation instructions

Follow the step-by-step instructions in the NXLog User Guide Integration Topic Microsoft Sentinel to configure this connector.