Mac Monitor

Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research, malware triage, and system troubleshooting. Leveraging Apple's Endpoint Security (ES) and System Extension APIs, it collects and enriches system events, displaying them graphically, with an expansive feature set designed to surface only the events that are relevant to you. The telemetry collected includes process, interprocess, memory, XPC, file events, and more in addition to rich metadata, allowing users to contextualize events and tell a story with ease. With an intuitive interface and a rich set of analysis features, Mac Monitor was designed for a wide range of skill levels and backgrounds to detect macOS threats that would otherwise go unnoticed.

OBTS v8.0 Presentation

Introducing the Next Generation of Mac Monitor:

• Slides (opens in a new tab)
• YouTube (opens in a new tab)

Requirements

• Processor: We recommend an Apple Silicon machine, but Intel works too!
• System memory: 4GB+ is recommended
• macOS version: 13.1+ (Ventura)

How can I install this thing?

(Recommended) Homebrew

• brew install --cask mac-monitor

Installer package

• Go to the releases section and download the latest installer: https://github.com/Brandon7CC/mac-monitor/releases

Install

• Open the app: Mac Monitor.app
• You'll be prompted to "Open System Settings" to "Allow" the System Extension.
• Next, System Settings will automatically open to Full Disk Access -- you'll need to flip the switch to enable this for the Mac Monitor Security Extension. Full Disk Access is a *requirement* of Endpoint Security (opens in a new tab).
• Click the "Start" button in the app and you'll be prompted to reopen the app. Done!

What are some standout features?

• High fidelity ES events modeled and enriched with some events containing further enrichment. For example, a process being File Quarantine-aware, a file being quarantined, code signing certificates, etc.
• Dynamic runtime ES event subscriptions. You have the ability to on-the-fly modify your event subscriptions -- enabling you to cut down on noise while you're working through traces.