I was wondering if anyone can help me out. I want to monitor macs using OS_query with sceduled queries that are saved to a log that I then send to sumologic. How can I track login attempts using osquery, liked failed and sucessful? I tried using account_policy_data but it is not giving me the results I want

successful logins are in

SELECT * FROM last

. not sure about failed logins and i’m interested to know this too.