sinter
sinter copied to clipboard
Integrate with macOS unified logging
Why
As a security engineer, I want logs from Sinter to be integrated with macOS logging so that I can export and parse these logs in the logging solution of my choice.
Acceptance Criteria
- Sinter logs will be displayed in the macOS logs console
- Authorization data should be inspectable (not just a message)
- eg: if Xcode is blocked, Sinter logs should give a reason why.
- Timestamp formatting updates (TBD based on client feedback)
Initial support for Unified Logging has been implemented as a new logger plugin which can be selected by setting Sinter.logger = "unifiedlogging" in the configuration file.
Messages are logged using the com.trailofbits.sinter subsystem, currently using the messages category. A new category named events will be added, for events related to exec authorizations.