The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

MacOS events

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

Logon Tracker also collects events on MacOS machines, which, for SSH, is the same as described in Linux events table. The “LT Assigned Status” column reflects the status that Logon Tracker assigns to each event. These statuses are relevant to the module configuration (see Configuring Logon Tracker agent policy) and the UI search functionality. For this release Logon Tracker collects SSH and Apple Remote Desktop (ARD) logon events.

Related articles
  • MacOS Events
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Module Overview > Logon Data Sources
  • MacOS events
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security (HX) Logon Tracker Module User Guide 1.3.x > Module overview > Logon data sources
  • Linux events
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Module overview > Logon data sources