Apple System Logs

Overview

Evidence: Apple System Logs Description: Collect Apple System Logs Category: System Platform: macOS Short Name: asl Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Apple System Logs (ASL) are the primary logging mechanism in macOS, providing detailed records of system events, application activities, and security-related events. These logs are stored in binary format in /private/var/log/asl/ and contain timestamps, process information, and detailed messages about system operations.

ASL logs are crucial for understanding system behavior, detecting security incidents, and reconstructing timelines of events. They capture authentication attempts, system errors, application launches, and various security events that are essential for forensic analysis.

Data Collected

This collector gathers structured data about apple system logs.

Unified Logs Data

Field	Description	Example
ID	Primary key (auto-increment)	1
PredicateType	Predicate type	process
TraceID	Trace ID	12345
EventMessage	Event message	Process launched
EventType	Event type	logEvent
Source	Log source	Safari
FormatString	Format string	Process %{public}@ launched
ActivityIdentifier	Activity identifier	123
Subsystem	Subsystem	com.apple.Safari
Category	Category	process
ThreadID	Thread ID	1
SenderImageUUID	Sender image UUID	12345678-1234-1234-1234-123456789012
Backtrace	Backtrace	0x12345678 0x87654321
ImageOffset	Image offset	0x1000
ImageUUID	Image UUID	87654321-4321-4321-4321-210987654321
BootUUID	Boot UUID	11111111-2222-3333-4444-555555555555
ProcessImagePath	Process image path	/Applications/Safari.app/Contents/MacOS/Safari
Timestamp	Event timestamp	2023-10-15 14:30:25
SenderImagePath	Sender image path	/System/Library/Frameworks/Foundation.framework/Foundation
MachTimestamp	Mach timestamp	1234567890123456
MessageType	Message type	Default
ProcessImageUUID	Process image UUID	99999999-8888-7777-6666-555555555555
ProcessID	Process ID	1234
SenderProgramCounter	Sender program counter	0x12345678
ParentActivityIdentifier	Parent activity identifier	122

Collection Method

This collector parses the necessary data from the asl table.

This collector collects files from the following locations:

• /private/var/log/asl/*.asl

Usage

Why This Evidence Matters for Forensics

Apple System Logs provide comprehensive visibility into system activities and are essential for incident response and forensic investigations. They contain detailed information about system events, user activities, and security-related occurrences that help reconstruct timelines and identify malicious behavior.

Investigative Questions This Evidence Can Answer:

• What system events occurred during a specific time period?

• Which applications were launched and when?

• Were there any authentication failures or security events?

Attack Detection:

• Failed authentication attempts and brute force attacks

• Unusual application launches or system modifications

• Privilege escalation attempts and security policy violations

Incident Response Applications:

• Reconstruct timeline of events leading to an incident

• Identify the scope and impact of security breaches

• Track user activities and system changes

Threat Hunting:

• Hunt for suspicious system events and anomalies

• Detect unauthorized application installations

• Identify patterns of malicious activity

Compliance & Security Posture:

• Audit system activities for compliance requirements

• Monitor security events and policy violations

• Verify proper logging and monitoring capabilities

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.