Update auditctl.yaml

[Pierre-Gronau-ndaal]

No description provided.

[tclahr]

Hi,
Can you provide me the source where you found auditctl is available for mac? I tested it on some macs I have and also did some research, but it seems that auditctl is not available for it.

[Pierre-Gronau-ndaal]

Hi, Can you provide me the source where you found auditctl is available for mac? I tested it on some macs I have and also did some research, but it seems that auditctl is not available for it.

It is available only for old systems

• https://medium.com/@boutnaru/the-macos-process-journey-auditd-audit-log-management-daemon-1addd6698016
• https://forums.developer.apple.com/forums/thread/732628

[tclahr]

I read the docs and actually macos auditd is not managed by auditctl. auditctl is part of linux's systemd.
But, I noticed that macos auditd daemon stores logs into /var/audit which is not collected by any artifact file.
So I am editing your PR to remove auditctl from macos and add /var/audit to be collected by files/logs/macos.yaml