skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

macOS Triage Analysis — SIFT Workstation Runbook

Triage macOS artifact collections with mac_apt and Unified Logs.

1|Updated Apr 25, 2026
Search Tags:#macos#incident response#artifact parsing#dfir triage#unified logs#tcc permissions#quarantine events
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill macos-triage-analysis-sift-workstation-runbook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macOS Triage Analysis — SIFT Workstation Runbook
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/macos-triage
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill macos-triage-analysis-sift-workstation-runbook

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This runbook reduces the time and uncertainty of macOS DFIR triage by guiding analysts through consistent artifact-only collection triage and timeline reconstruction from a macOS triage package.

Core Features & Use Cases

  • Artifact-first parsing with mac_apt: Use mac_apt artifact-only plugins to extract structured evidence such as browser history, downloads, quarantine events, persistence locations, TCC permissions, and application activity from a live-collected triage directory.
  • Unified Log reconstruction: Parse macOS Unified Log archives into JSONL and use targeted searches to determine whether specific app launches succeeded or were blocked by security policy.
  • SQLite/CoreData timestamp normalization: Run focused SQLite queries against macOS databases (including correct CoreData epoch conversion) to produce analyst-ready CSV timelines.

Quick Start

Ask Claude Code to run the macOS triage runbook by opening the case directory and invoking the investigation flow for the macOS host so it can start phase 0 log parsing immediately and then extract high-value artifacts like Safari, TCC, quarantine events, and persistence.

Frequently Asked Questions about macOS Triage Analysis — SIFT Workstation Runbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct a macOS incident timeline from artifact-only triage collections?▼

Reconstruct macOS activity by parsing triage artifacts with mac_apt, extracting browser history, quarantine events, and TCC permissions, then normalizing SQLite and CoreData timestamps into analyst-ready CSV and JSONL timelines.

How do I convert macOS CoreData timestamps to UTC during DFIR triage?▼

Convert macOS CoreData timestamps to UTC by running focused SQLite queries against macOS databases with correct CoreData epoch conversion, producing normalized CSV timelines for incident response analysis.

Can I check TCC permissions and quarantine events from a collected macOS triage package?▼

Check TCC permissions and quarantine events by using mac_apt artifact-only plugins to extract structured evidence from a macOS triage directory, tracking application consent and download provenance.

How do I parse macOS Unified Logs to validate application execution success in an incident response scenario?▼

Parse macOS Unified Log archives into JSONL and run targeted searches to determine whether specific application launches succeeded or were blocked by security policy during incident triage.

What's the best way to sequence macOS DFIR analysis phases when parsing large triage packages?▼

Sequence macOS DFIR analysis by starting with long-running Unified Log parsing in phase zero, then extracting high-value artifacts like Safari history, TCC permissions, quarantine events, and persistence locations.

Related Skills

Explore More Legal & Compliance Skills→
Kalp1774Kalp1774
18

recon

Run subdomain enumeration, DNS resolution, live-host probing, and nmap scanning on a target.

Community
Intermediate
xjtu-wangxjtu-wang
4

competition-forensic-timeline

Correlate EVTX, Sysmon, registry, memory, and PCAP artifacts into a defendable attacker timeline.

Community
Advanced
kofttlcckofttlcc
14

youtube-downloader

Download YouTube videos with configurable quality, format, and output directory.

Community
Intermediate
rjonhaasrjonhaas
1

EDR Telemetry & Live Hunt Collections

Analyze EDR exports and Velociraptor ZIPs to extract suspicious processes and persistence signals.

Community
Advanced