Reading Auth Logs on Mac devices

HaydenB0101
Fri, 27 Feb 2026 17:19:30 +0000
Elastic Agent

I want to get auth. logs from my mac devices and am struggling to find a working integration to use.

I have been using the Custom macOS Unified Logs integration to try and get this data from the devices since it’s the only mac related integration I could find. I’m getting logs from the agent that an event related to failed authentication happened, but I’m not getting any data about that event.

Are there good integrations that exist that support macs that are recommended to use, or are there services that can run to get the data from unified log?

1 post - 1 participant