diff --git a/CHANGELOG.md b/CHANGELOG.md index 89ce5d85..fa930266 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ - files/applications/katesession.yaml: Added colleection of metadata about recently opened files in Kwrite and Kate text editors [freebsd, linux, netbsd, openbsd]. - files/applications/nano.yaml: Added collection of nano history file [all] (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal)). - files/applications/okular.yaml: Added collection of metadata related to documents that have been opened or interacted with using Okular, a document viewer for KDE [freebsd, linux, netbsd, openbsd]. +- files/logs/macos_unified_logs.yaml: Updated to include the collection of ASL logs [macos] (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal)). - files/system/gvfs_metadata.yaml: Added collection of data from the gvfs-metadata directory to retrieve user-specific metadata, such as file access details, custom properties, and interaction history [freebsd, linux, netbsd, openbsd]. - files/system/kactivitymanagerd.yaml: Added collection of activity tracking data used by KActivityManager (part of KDE) to track and manage user activities, such as recently opened files, applications, and other resources [freebsd, linux, netbsd, openbsd]. - files/system/upstart.yaml: Added collection of system-wide and user-session Upstart configuration files [linux]. diff --git a/artifacts/files/logs/macos_unified_logs.yaml b/artifacts/files/logs/macos_unified_logs.yaml index f28c3618..c69d5c25 100644 --- a/artifacts/files/logs/macos_unified_logs.yaml +++ b/artifacts/files/logs/macos_unified_logs.yaml @@ -1,4 +1,4 @@ -version: 4.0 +version: 4.1 artifacts: - description: Collect macOS Unified Logs tracev3 files. @@ -16,4 +16,24 @@ artifacts: supported_os: [macos] collector: file path: /private/var/db/diagnostics/timesync - \ No newline at end of file + - + description: Collect macOS Apple System Logs (ASL) files. + supported_os: [macos] + collector: file + path: /private/var/log/asl.db + max_file_size: 1073741824 # 1GB + - + description: Collect macOS Apple System Logs (ASL) files. + supported_os: [macos] + collector: file + path: /private/var/log/asl.log + max_file_size: 1073741824 # 1GB + - + description: Collect macOS Apple System Logs (ASL) files. + supported_os: [macos] + collector: file + path: /private/var/log/asl/* + max_file_size: 1073741824 # 1GB + +# References: +# https://darkdefender.medium.com/brief-introduction-to-macos-forensics-f817c9c83609 \ No newline at end of file