#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $
#
dir:/var/audit
flags:lo,aa,fc,fd,pc,nt,ex      <- edit here like this
minfree:5
naflags:lo,aa,fc,fd,pc,nt,ex    <- edit here like this
policy:cnt,argv
filesz:2M
expire-after:10M
superuser-set-sflags-mask:has_authenticated,has_console_access
superuser-clear-sflags-mask:has_authenticated,has_console_access
member-set-sflags-mask:
member-clear-sflags-mask:has_authenticated

$ sudo python3 ./norimaci.py -m openbsm -o ./out/
Password:

--===[ Norimaci v0.1.0
--===[ Minoru Kobayashi [@unkn0wnbit]
[*] Launching OpenBSM agent...
[*] When runtime is complete, press CTRL+C to stop logging.
^C
[*] Termination of OpenBSM agent commencing... please wait
[*] Converting OpenBSM data ...
[*] Loading converted macOS activity data ...
[*] Saving report to: /Users/macforensics/tools/norimaci/out/Norimaci_14_Jan_20__15_55_093219.txt
[*] Saving timeline to: /Users/macforensics/tools/norimaci/out/Norimaci_14_Jan_20__15_55_093219_timeline.csv

$ python3 ./norimaci.py -h

--===[ Norimaci v0.1.0
--===[ Minoru Kobayashi [@unkn0wnbit]
usage: norimaci.py [-h] [-m MONITOR] [-j JSON] [-bl OPENBSM_LOG] [-p PROCLIST]
                   [-ml MONITORAPP_LOG] [-o OUTPUT] [--force] [--debug]

Light weight sandbox which works with OpenBSM or Fireeye's Monitor.app

optional arguments:
  -h, --help            show this help message and exit
  -m MONITOR, --monitor MONITOR
                        Specify a program to monitor macOS activity. You can
                        choose 'openbsm' or 'monitorapp'.
  -j JSON, --json JSON  Path to a JSON file which is converted by
                        'openbsmconv.py' or 'monitorappconv.py'.
  -bl OPENBSM_LOG, --openbsm-log OPENBSM_LOG
                        Path to an OpenBSM log file.
  -p PROCLIST, --proclist PROCLIST
                        Path to a process list file to process OpenBSM log
                        file. A file which has ".proclist" extnsion would be
                        used, if this option is not specified.
  -ml MONITORAPP_LOG, --monitorapp-log MONITORAPP_LOG
                        Path to a Monitor.app data file.
  -o OUTPUT, --output OUTPUT
                        Path to an output directory.
  --force               Enable to overwrite output files.
  --debug               Enable debug mode.

$ python3 ./openbsmconv.py -h
usage: openbsmconv.py [-h] [-f FILE] [-p PROCLIST] [-o OUT] [-c] [-rp]
                      [--with-failure] [--with-failure-socket] [--force]
                      [--debug]

Converts OpenBSM log file to JSON format.

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Path to a bsm log file
  -p PROCLIST, --proclist PROCLIST
                        Path to a process list file
  -o OUT, --out OUT     Path to an output file
  -c, --console         Output JSON data to stdout.
  -rp, --use-running-proclist
                        Use current running process list instead of a existing
                        process list file. And, the process list is saved to a
                        file which places in the same directory of '--file' or
                        to a file which specified '--proclist'.
  --with-failure        Output records which has a failure status too.
  --with-failure-socket
                        Output records which has a failure status too (related
                        socket() syscall only).
  --force               Enable to overwrite an existing output file.
  --debug               Enable debug mode.

$ python3 ./monitorappconv.py -h
usage: monitorappconv.py [-h] [-f FILE] [-o OUT] [-c] [--force] [--debug]

Parses data of Fireeye Monitor.app and converts it to JSON format. Please note
that strings in JSON data are saved as UTF-8.

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Path to a saved data of Monitor.app.
  -o OUT, --out OUT     Path to an output file.
  -c, --console         Output JSON data to stdout.
  --force               Enable to overwrite an output file.
  --debug               Enable debug mode.

git clone https://github.com/mnrkbys/norimaci.git