Reference Library for macOS workstation Falco Threat Detection Rules

Sysdig Secure enables you to create and customize Threat Detection Rules to secure your environment. This topic provides all the fields and events that apply to Falco rules for macOS workstations.

Fields

Field Class: macOS Workstation

Name	Type	Description
`proc.pid`	UINT64	Process ID
`proc.exepath`	CHARBUF	Executable path
`proc.name`	CHARBUF	Executable basename
`proc.args`	CHARBUF	Command line arguments
`proc.cmdline`	CHARBUF	Process command line (name + args)
`proc.ppid`	UINT64	Parent process ID
`mac.uid`	UINT64	User ID
`mac.gid`	UINT64	Group ID
`evt.type`	CHARBUF	Event type name
`evt.category`	CHARBUF	Event category
`mac.evt.num`	UINT64	Event counter
`mac.evt.rawtime`	UINT64	Raw epoch nanoseconds
`fd.name`	CHARBUF	File path or network tuple
`fd.directory`	CHARBUF	Parent directory
`fd.filename`	CHARBUF	File basename
`fd.sip`	CHARBUF	Server IP address
`fd.cip`	CHARBUF	Client IP address
`fd.sport`	UINT64	Server port
`fd.cport`	UINT64	Client port
`fd.rip`	CHARBUF	Remote IP address
`fd.lip`	CHARBUF	Local IP address
`fd.rport`	UINT64	Remote port
`fd.lport`	UINT64	Local port
`fd.l4proto`	CHARBUF	Layer 4 protocol
`mac.signal`	UINT64	Signal number
`mac.target.pid`	UINT64	Target PID
`mac.target.exe`	CHARBUF	Target executable
`mac.dns.name`	CHARBUF	DNS query name
`mac.dns.rcode`	UINT64	DNS response code
`mac.dns.answers`	CHARBUF	DNS resolved addresses
`proc.cwd`	CHARBUF	Process current working directory
`proc.pname`	CHARBUF	Parent process name
`proc.pexe`	CHARBUF	Parent executable path
`proc.pcmdline`	CHARBUF	Parent command line
`proc.duration`	UINT64	Process duration in nanoseconds
`proc.nthreads`	UINT64	Number of threads
`proc.fdopencount`	UINT64	Number of open files
`proc.pid.ts`	UINT64	Process start time (epoch ns)
`user.uid`	UINT64	Real user ID
`user.name`	CHARBUF	Username
`group.gid`	UINT64	Real group ID
`group.name`	CHARBUF	Group name
`proc.sid`	UINT64	Audit session ID
`proc.apid`	UINT64	Ancestor PID
`proc.aname`	CHARBUF	Ancestor name chain (child::parent::grandparent::… up to init or 16 levels)
`proc.aexe`	CHARBUF	Ancestor exe chain (child::parent::grandparent::… up to init or 16 levels)
`evt.count`	UINT64	Event count (always 1)
`evt.args`	CHARBUF	All event arguments
`evt.arg`	CHARBUF	Single event argument by name (use evt.args for all)
`proc.exeline`	CHARBUF	Process exe path and arguments
`fd.type`	CHARBUF	File descriptor type
`fd.typechar`	CHARBUF	File descriptor type character
`fd.sockfamily`	CHARBUF	Socket family
`mac.exepath`	CHARBUF	Process executable path (alias of proc.exepath)
`evt.is_io`	UINT64	True for I/O events
`evt.is_io_read`	UINT64	True for read I/O events
`evt.is_io_write`	UINT64	True for write I/O events
`evt.res`	CHARBUF	Event result as string
`evt.rawres`	UINT64	Event result as number
`evt.failed`	UINT64	True if event failed
`fd.is_server`	UINT64	True for server connections
`user.homedir`	CHARBUF	User home directory
`user.shell`	CHARBUF	User login shell
`user.loginname`	CHARBUF	User login name
`mac.fd.domain`	CHARBUF	Domain name from DNS resolution for network connections
`mac.line`	CHARBUF	Full sysdig-style output line: evtnum time procname (pid.tid) evtname args
`thread.tid`	UINT64	Thread ID
`mac.btm.executable_path`	CHARBUF	Path to the executable for a registered Background Task Manager item (LaunchAgent, LaunchDaemon, or login item). Available on btm_launch_item_add / btm_launch_item_remove events.
`mac.btm.item_type`	UINT64	BTM item kind: 0=USER_ITEM, 1=APP, 2=LOGIN_ITEM, 3=AGENT (LaunchAgent), 4=DAEMON (LaunchDaemon).
`mac.btm.legacy`	UINT64	1 if the item was registered via a legacy plist drop (vs SMAppService), 0 otherwise.
`mac.btm.managed`	UINT64	1 if the item was installed by an MDM / configuration profile, 0 otherwise.
`mac.btm.uid`	UINT64	Owning user uid for the BTM item (0 = system-wide LaunchDaemon).
`mac.profile.identifier`	CHARBUF	Configuration profile identifier on profile_add / profile_remove events.