About this Guide

This guide introduces the functionality of the Snare Enterprise Agent for macOS operating system.  Snare Enterprise Agent for macOS provides an events collection capability and facilitates audit policy-based filtering and remote delivery. Snare Agent collects events generated by audit subsystem of macOS, events from text-based log files, and events generated by Snare File Integrity Monitoring (FIM) module. Security administrators can configure and monitor the Snare Agent via a web user interface and/or via a command line allowing for automated process. Snare Agents are designed to be extremely light-weight and to forward the collected events to a central server or SIEM.

For the list of supported macOS versions please refer to:
https://prophecyinternational.atlassian.net/wiki/x/3YK4Iw#Apple-macOS

The first release of Snare for macOS Agent in the version 5 series, is version 5.3.0.

For OSX support, please consider Snare Agent for OSX v4.