Support for MacOS

[toliver38]

I'd like to bring up a potential enhancement to our current Ghosts project: adding a MacOS agent. As someone relatively new to this community, I'm not sure if this has already been considered or if there are any plans underway, so I'd appreciate your input.

Here's why I think this would be beneficial:

1. Broader user pool to mimic - the environments I deal with today are heavily MacOS users
2. Training our users on MacOS "normal" activity vs malicious is currently difficult due to lack of volume in our training environment
3. Enhancing Cross-platform Analysis: Inclusion of MacOS would enable a more comprehensive cross-platform security analysis, crucial for multi-platform environments. Especially interesting as MacOS activity leaps between other devices.

I'd love to hear any thoughts on this, particularly any existing plans. Understand this is probably not a priority but if there is anyone considering it I'd be up for collaborating

Great work so far on the whole CMU-SEI project. Hopefully I can get more involved as an outside contributor

[sei-dupdyke]

I am not opposed to this, but I have questions about how to prioritize.

1. If you are using this on a range, how are you virtualizing Mac hosts? Or are these actually physical machines for each host?
2. What kinds of activities are you wanting to enable for ghosts? (I have always thought that activities on different OSes are really quite different—at least for training and exercise purposes—but maybe that is less true these days?)