Add Cortex XDR macOS telemetry mappings — 47 sub-categories

[malwr4n6]

Description

This PR adds Palo Alto Cortex XDR telemetry mappings for macOS across 47 sub-categories, verified via the EDR Telemetry test script and direct Cortex XDR cloud console log export.

Environment Details

• Operating System: Apple macOS Tahoe (26.5.1)
• Architecture: Apple Silicon (ARM64)
• Vendor/Sensor: Palo Alto Networks Cortex XDR Agent
• Agent Version: 9.0.0.6334
• Content Version: 2320-38124
• Policy: macOS Default

Evidence will be shared privately with the maintainer on request.

Sub-Categories Updated (47)

Category	Sub-Categories
Process Activity	Process Creation, Process Termination
File Activity	File Creation, File Modification, File Deletion, File Attribute Change, File Open/Access
User & Session Activity	User Logon, User Logoff, Privilege Escalation (sudo etc.)
Script Activity	Script Content
Network Activity	Network Connection, Network Socket Listen, DNS Query
Scheduled Task & Persistence Activity	Scheduled Task Change (cron/at), Launchd Item Created, Launchd Item Modified, Launchd Item Deleted, LoginItem Created, LoginItem Deleted
User Account Activity	User Account Created, User Account Modified, User Account Deleted
System Extension & Driver Activity	System Extension Installed, System Extension Loaded, System Extension Uninstalled, Kernel Extension Loaded (legacy)
Code Signing & Trust Activity	Binary Signature Info Recorded, Notarization Status Recorded, Quarantine Flag Set, Quarantine Flag Cleared, Gatekeeper Decision Logged
Privacy & TCC Activity	TCC Prompt Shown, TCC Decision (Allow), TCC Decision (Deny), TCC Policy Change, TCC Access Check
Access Activity	Raw Device Access, Process Access
Process Tampering Activity	Process Injection Or Tampering
Device Activity	External Media Mounted, External Media Unmounted
File Metadata	MD5 Available, SHA-256 Available
Service Activity	Service Created, Service Modified, Service Deleted

Not Yet Confirmed (left empty)

Logon Failed, Screen Lock, Screen Unlock, Group Membership Modified, DriverKit Extension Loaded, XProtect Detection Logged, XProtect Remediation Logged, Agent Start, Agent Stop, Agent Protection Disabled or Tamper Event, Fuzzy Hash Available.

[tsale]

Thanks for sending the evidence over email. I’ve reviewed both files, and they support several mappings, but not all 47 Yes entries.

The main gaps are:

• Launchd/service plist changes and TCC/background-items database activity are generic file events, not direct events for the claimed actions.
• Script Content shows the script path and execution, but not the captured script contents.
• DNS traffic and incoming connections do not establish DNS query or socket-listen telemetry.
• The other lifecycle and security-action mappings still need matching direct events.

Also, Success in the generator CSV confirms the test function returned successfully, not that Cortex captured the expected event.

Could you narrow the PR to the supported mappings, or provide the specific event records and fields supporting the remaining Yes entries? Please include the export query/source and timezone so we can correlate them reliably.