Send Outbound audit logs to a SIEM

Step by step

1. Choose a protected export directory. Create a directory appropriate for your collector. Grant the app user write permission and the collector read permission; restrict other access as needed.
2. Force AuditExportPath. Use the managed-preferences profile to set AuditExportPath to that directory. Confirm that the setting is forced, not just a user default.
3. Generate a controlled event. Make a known connection and apply a rule. Check the local audit log and the exported UTC day file for its verdict and reason.
4. Configure the collector. Parse one JSON object per line. Track file offsets across updates and avoid ingesting the same full-day export repeatedly. Apply your own retention policy.
5. Test an export failure. Temporarily use an unwritable test destination on a pilot Mac. Confirm that the local log continues and that the app reports the export failure. Restore the correct path.

File naming and retention

Outbound uses YYYY-MM-DD.jsonl filenames based on UTC and keeps 30 days locally. Export copies complete lines at most once a minute. Destination retention belongs to your collector and storage policy.

Illustrative event

The following is a redacted example matching the audit structure, not a captured customer event.

{"timestamp":"2026-10-04T09:00:00Z","flow":{"path":"/usr/bin/curl","remoteHost":"example.com","remotePort":443,"proto":"tcp","direction":"outgoing"},"verdict":"deny","reason":"Illustrative rule decision"}

Available fields include process identity, destination, protocol, direction, verdict and reason. Optional fields may be absent; do not turn a missing hostname into an empty or trusted destination.

On-demand export

outboundctl audit export --to /path/to/audit-export

Replace the example path with the directory you prepared. When run as root without a store override, outboundctl uses the console user’s container and refuses to proceed if nobody is signed in.

Use the IT configuration reference and CLI reference as the product sources. JSON Lines is documented at jsonlines.org.