Hello guys. Has anyone managed to enable

user_events

table on MacOS? I've enabled the following tables but still am not getting anything:

--audit_allow_config
--audit_allow_user_events
--disable_audit=false
--disable_events=false

there are a couple of more flags needed

--enable_keyboard_events=true

and

--enable_mouse_events=true

, and osquery will also need relevant macOS permissions

Thanks for the quick response. By relevant macos permissions, would you be referring to the correct auditd configuration? I've modified mine to match the one suggested in the osquery docs. Just wondering if I missed out on any other macos settings

No, these are the “Input Monitoring” permissions in macOS system preference/settings, osquery will need to be on the allow list there iirc

Gave your suggestion a go, I see events under user_interaction_events rather than user_events

ah okay..I see, I think you might have to add relevant flags to your

/etc/security/audit_control

file

Gotcha, I'll tinker around. Cheers!

cool, let us know! I will try to poke around when I have time, but a few relevant links: https://man.freebsd.org/cgi/man.cgi?apropos=0&sektion=5&query=audit_control&manpath=FreeBSD+7.0-current&format=html and https://man.freebsd.org/cgi/man.cgi?query=audit_user&sektion=5&apropos=0&manpath=FreeBSD+13.2-RELEASE+and+Ports