Manual evidence collection for macOS endpoints

Procedure

1. Select Agentic SIEM & XDR → Forensics → Packages.
2. Click Collect Evidence.
3. Configure the following settings for manual collection.

   Setting	Description
   Evidence types	The types of evidence to collect. For macOS endpoints, you need the following information: Basic information Process information Service information Network information Account information User activity
   Archive location on endpoint	Location of the evidence package on the local endpoint. Important The local archive does not have encryption and remains on the endpoint until deleted. This might allow anyone with access to the file system to access sensitive information or reveal the presence of an ongoing investigation. Evidence archives take up hard drive space which may impact endpoint performance.

4. Click to download the Trend Micro Incident Response Toolkit.
5. Deploy the toolkit on the endpoints you want to collect evidence.
6. Execute the toolkit.
   1. Extract the contents of the .zip archive.
   2. Execute TMIRT.sh as the root user.
7. If you do not have privileges for executing scripts, execute the following commands.
   1. To extract the toolkit from the .tgz file, execute xattr -c ./TMIRT-macos.tgz and then ./tar -xf.
   2. To begin collecting evidence, execute ./TMIRT-bin evidence --config_file ./config.json.
8. Upload the evidence packages that the toolkit generates to Forensics. You can upload multiple files at once. Each file must not exceed 4 GB.