Metrics monitored by DEX on macOS
Review the endpoint performance and compliance metrics that DEX collects from managed macOS devices, including collection intervals, and associated check definitions and policies.
Application metrics
| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required Privileges |
|---|---|---|---|---|---|---|---|
| Application version | appVersion | Version string of the installed Mac application. Snapshot metric retrieved via the osquery apps table. |
Single metric — appVersion (string) |
N/A | 1,440 | os.mac.check-app-version | Sudo permissions |
| CPU usage | cpu_usage | Percentage of CPU consumed by the target application's processes. Point-in-time gauge sampled every 5 minutes; rounded to 2 decimal places. | Single metric — cpu_usage (percentage, gauge) |
% | 5 | os.mac.check-app-cpu-usage | No elevated privileges required |
| Crashes | crashes | Count of application crashes and crash event details. Source: osquery crash_log table. |
crashes (count); crash_details (array): timestamp, process_name, responsible, exception_type, signal |
count | 5 | os.mac.check-app-crashes | Sudo permissions |
| Freezes | freezes | Count of application freeze or hang events on the device. | Single metric — freezes (count) per application. |
count | 5 | os.mac.check-app-freezes | Sudo permissions |
| IO usage (read) | io_usage_read | Bytes read per second from disk by application processes. | Single metric — io_usage_read (bytes/second, gauge) |
Bps | 5 | os.mac.check-app-io-usage-read | Sudo permissions |
| IO usage (write) | io_usage_write | Bytes written per second to disk by application processes. | Single metric — io_usage_write (bytes/second, gauge) |
Bps | 5 | os.mac.check-app-io-usage-write | Sudo permissions |
| Is installed | is_installed | Boolean indicating whether the target application is installed on the device. Prerequisite for all other application metrics. | Single metric — is_installed (boolean) |
Boolean | N/A | os.mac.check-app-is-installed | Sudo permissions |
| Is running | is_running | Boolean indicating whether at least one process of the target application is currently running. | Single metric — is_running (boolean, gauge) |
Boolean | 5 | os.mac.check-app-is-running | Sudo permissions |
| Last access time | last_access_time | Unix timestamp (milliseconds) of the last time the application was observed running. Daily snapshot. Sudo permissions are required. Note: Data is available only for the past 7 days due to macOS log retention limits. |
Single metric — last_access_time (milliseconds since epoch) |
milliseconds | 5 | os.mac.check-app-last-access-time | Sudo permissions |
| Last updated | last_updated | Timestamp of the most recent application update installation. Derived from the mdls command which reads file system extended attributes of the .app bundle.Sudo permissions are required. |
Single metric — last_updated (Unix timestamp) |
seconds | N/A | os.mac.check-app-last-updated | Sudo permissions |
| Listening ports | listening_ports | List of TCP and UDP port numbers on which the application is actively listening. Latest snapshot only; not stored historically. | Single metric — listening_ports (array of integer port numbers) |
N/A | N/A | os.mac.check-app-listening-ports | Sudo permissions |
| RAM usage | memory_usage | Percentage of physical RAM consumed by the target application's processes relative to total system RAM. | Single metric — memory_usage (percentage, gauge) |
% | 5 | os.mac.check-app-memory-usage | No elevated privileges required |
| Uptime | uptime | Continuous running time of each application process in milliseconds since its last start. Derived from the ps command elapsed time. |
Single metric — uptime (milliseconds, gauge) |
milliseconds | 5 | os.mac.check-app-uptime | No elevated privileges required |
Device metrics
| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required privileges |
|---|---|---|---|---|---|---|---|
| Admin users | admin_users | List of local macOS user accounts with administrator (admin group) privileges. Snapshot only. | admin_users (array): username (string), uid (integer) |
N/A | N/A | os.mac.check-system-admin-users | No elevated privileges required |
| Battery charge percentage | battery_charge_percentage | Current macOS battery charge percentage from osquery battery table. Integer value 0-100. |
Single metric — battery_charge_percentage (integer %, gauge) with battery_id attribute |
% | 5 | os.mac.check-system-battery-charge-percentage | No elevated privileges required |
| Battery details | battery_details | Comprehensive macOS battery health snapshot from osquery battery table. Includes charge percentage, health, condition, cycle count, design and full-charge capacity (converted from mAh to mWh using design
voltage), maximum capacity percentage, and installed battery count. |
charge_percentage (%); health (Good/Moderate/Poor); condition; cycle_count; designed_capacity (mWh);
full_charge_capacity (mWh); maximum_capacity (%); design_voltage (volts); installed_batteries (count) |
N/A | 1,440 | os.mac.check-system-battery-details | No elevated privileges required |
| CPU details | cpu_details | macOS CPU hardware details including model name, physical processor count, logical processor count, and architecture. Daily snapshot. | model; number_of_cores; number_of_logical_processors; architecture (e.g., arm64 or x86_64) |
N/A | 1,440 | os.mac.check-system-cpu-details | No elevated privileges required |
| CPU usage | cpu_usage | Aggregate CPU utilization percentage across all CPU cores on macOS. Computed as 100 minus the average idle percentage across all cores, parsed from the top command output. |
Single metric — cpu_usage (percentage, gauge) |
% | 5 | os.mac.check-system-cpu-usage | No elevated privileges required |
| Device crashes | crashes | Count of device-level crashes (kernel panics, system crashes) on macOS within the 5-minute collection window. | Single metric — crashes (count per 5-min window, gauge) |
count | 5 | os.mac.check-system-crashes | No elevated privileges required |
| Device details | device_details | macOS hardware identity snapshot: model name, serial number, and device type via system_profiler SPHardwareDataType. |
model (e.g., MacBook Pro 14-inch); serial_number; device_type |
N/A | 1,440 | os.mac.check-system-device-details | No elevated privileges required |
| Device events | device_events | macOS device events during a specified time interval. Captures six event types: last_boot, logged_in_users, softwares_installed, softwares_updated, users_added, and passwords_reset. Sudo permissions are required. |
last_boot (timestamp); logged_in_users (array); softwares_installed (array); softwares_updated (array); users_added (array);
passwords_reset (array) |
N/A | 1,440 | os.mac.check-system-device-events | Sudo permissions |
| Disk details | disk_details | Per-disk snapshot of total space, free space, and used space in bytes for the primary macOS disk. Data from the osquery mounts table (path = '/'). | total_space (bytes); free_space (bytes); used_space (bytes) |
N/A | 1,440 | os.mac.check-system-disk-details | No elevated privileges required |
| Disk IO usage (read) | io_usage_read | Device-wide disk read throughput in bytes per second on macOS. Two-sample delta from osquery processes table disk_bytes_read. |
Single metric — io_usage_read (bytes/second, gauge) |
Bps | 5 | os.mac.check-system-disk-io-usage-read | Sudo permissions |
| Disk IO usage (write) | io_usage_write | Device-wide disk write throughput in bytes per second on macOS. | Single metric — io_usage_write (bytes/second, gauge) |
Bps | 5 | os.mac.check-system-disk-io-usage-write | Sudo permissions |
| Disk usage* | disk_usage | Percentage of primary disk space used on macOS, computed as (total - free) / total * 100. |
Single metric — disk_usage (percentage, gauge) |
% | 5 | os.mac.check-system-disk-usage | No elevated privileges required |
| Energy consumption | energy_consumption | Energy consumed by the macOS device over the next 5-minute window in milliwatt-hours. Measured via the macOS
powermetrics tool. |
Single metric — energy_consumption (milliwatt-hour, gauge) with battery_id attribute |
mWh | 5 | os.mac.check-system-energy-consumption | Sudo permissions |
| Firewall enabled | firewall_enabled | Boolean status of the macOS application-layer firewall (Application Firewall / socketfilterfw). |
Single metric — firewall_enabled (boolean) |
N/A | 1,440 | os.mac.check-system-firewall-enabled | No elevated privileges required |
| Incoming network bytes | incoming_bytes | Total incoming network bytes per second aggregated across all network interfaces on macOS. Two-sample delta calculation from osquery interface_details table. |
Single metric — incoming_bytes (bytes/second, gauge) |
Bps | N/A | os.mac.check-system-net-bytes-incoming | No elevated privileges required |
| Last access time | last_access_time | Unix timestamp (milliseconds) of the last time the macOS device was physically accessed by a user, based on display activity. Note: Works with the display on or off. |
Single metric — last_access_time (milliseconds since epoch) |
milliseconds | 1,440 | os.mac.check-system-last-access-time | No elevated privileges required |
| Logged-in users | logged_in | List of users currently logged into the macOS including username and uid. | logged_in (array): user (string); uid (integer) |
N/A | 1,440 | os.mac.check-system-logged-in-users | No elevated privileges required |
| Network connectivity details | network_details | Full network interface snapshot for both Wi-Fi and Ethernet on macOS. | Wi-Fi: name; ssid; bssid; channel; rssi (dBm); transmit_rate (Mbps); mac_address;
stateEthernet: |
N/A | 1,440 | os.mac.check-system-network-details | No elevated privileges required |
| OS details | os_details | macOS inventory snapshot: OS name (for example, macOS Ventura), version, platform (darwin), architecture, and install date. | name; version; platform; architecture; install_date (timestamp) |
N/A | 1,440 | os.mac.check-system-os-details | No elevated privileges required |
| OS setup details | os_setup_details | Approximate age of the macOS installation, indicating how long the current OS has been set up on the device. | os_install_date (timestamp); os_age_days (integer) |
N/A | 1,440 | os.mac.check-system-os-setup-details | No elevated privileges required |
| Outgoing network bytes | outgoing_bytes | Total outgoing network bytes per second across all macOS network interfaces. Two-sample delta from osquery interface_details
outbytes column. |
Single metric — outgoing_bytes (bytes/second, gauge) |
Bps | N/A | os.mac.check-system-net-bytes-outgoing | No elevated privileges required |
| Pending system updates | pending_updates | List of available pending software updates on macOS (both system and app store updates). | Per update: update_name; version; description; restart_required |
N/A | 1,440 | os.mac.check-system-pending-updates | No elevated privileges required |
| Power consumption | power_consumption | Instantaneous power consumption of the macOS device in milliwatts via powermetrics. |
Single metric — power_consumption (milliwatts, gauge) |
mW | 5 | os.mac.check-system-power-consumption | Sudo permissions |
| RAM usage | memory_usage | System-wide physical memory utilization percentage on macOS. Calculated from vm_stat output. |
memory_total (bytes); memory_available (bytes); memory_usage (bytes); memory_usage_percentage (gauge) |
% | 5 | os.mac.check-system-memory-usage | No elevated privileges required |
| Reboot details | reboot_details | Last reboot timestamp for the macOS device. Calculated from osquery system_info uptime. |
last_reboot_timestamp (Unix timestamp in seconds) |
seconds | 1,440 | os.mac.check-system-reboot-details | No elevated privileges required |
| Session details | session_details | Session duration in minutes for each currently logged-in user on the macOS. | Array of session objects: user (username); session_time (minutes since login) |
minutes | 1,440 | os.mac.check-system-session-details | No elevated privileges required |
| System compliance | system_compliance_details | Compliance rating (percentage) for the macOS device based on configured compliance rules. Lists non-compliant metrics and apps. | compliance_rating (percentage); non_compliant_apps (array); non_compliant_metrics (array) |
% | 1,440 | os.mac.check-system-compliance-details | No elevated privileges required |
| System time | time | Current macOS system time as Unix epoch seconds (UTC). Used for time-drift detection and telemetry alignment. | Single metric — time (Unix epoch seconds, gauge) |
seconds | N/A | os.mac.check-system-time | No elevated privileges required |
| Uptime | uptime | Time in milliseconds since the last device boot on macOS. Derived from osquery system_info. |
Single metric — uptime (milliseconds, gauge) |
milliseconds | 5 | os.mac.check-system-uptime | No elevated privileges required |
| VPN details | vpn_details | VPN connection status on macOS as a boolean. Detected by comparing DNS search domains in the resolver versus macOS network settings. | vpn_status (boolean); vpn_domains (array of detected VPN search domains) |
Boolean | 30 | os.mac.check-system-vpn-details | No elevated privileges required |
| Wi-Fi RSSI | wifi_rssi | Wi-Fi RSSI (Received Signal Strength Indicator) in dBm from osquery wifi_status table. Negative integer value (for example, -65 dBm). |
Single metric — wifi_rssi (dBm, negative integer, gauge) |
dBm | 5 | os.mac.check-system-wifi-rssi | Sudo permissions |
| Wi-Fi transmit rate | wifi_transmit_rate | Wi-Fi transmit rate in Mbps on macOS from osquery wifi_status table. |
Single metric — wifi_transmit_rate (Mbps, gauge) |
Mbps | 5 | os.mac.check-system-wifi-transmit-rate | Sudo permissions |
Note:
* The Disk Usage metric reports storage consumption. For disk I/O throughput by process, see the Disk Usage action in Digital End-User Experience remedial actions.