Skip to main content
Where the Mac-side OS telemetry pack lives, how it gets onto the host, and which Splunk indexes it populates. Pack internals, including Sources, predicates, override patterns, and version-to-version changelogs, live in the repo’s own README.
Language: Shell  ·  Status: active  ·  Last active: this week  ·  Source on GitHub
This page is the homelab-integration view of cc-edge-the-mac-pack-io. It covers where the pack runs, what it sends, and how it slots into the wider observability stack. For the full Cribl-side reference, including every Source, every input, anomaly detection rules, override patterns, and release notes, read the repo’s README.

​
Where it runs

The pack targets a native macOS Cribl Edge install, managed declaratively by nix-darwin. Three install constraints from this homelab’s posture:
  • The Edge install must be native to the Mac. Exec inputs in the pack invoke macOS-only binaries (pmset, ioreg, powermetrics) and do not work from a Linux container.
  • The Mac runs Cribl Edge directly, not through OrbStack. The K8s cluster runs unrelated Cribl Edge instances for different workloads, and this pack does not target them.
  • Each Mac’s Edge runs standalone. No Cribl Leader manages it, and enrolling Macs in a hosted-service fleet is explicitly forbidden. Configuration uses GitOps. The nix-darwin host config pins the pack version. Updating it means bumping the pin and rebuilding. A Leader or hosted service does not push configuration.

​
What it sends

Data lands in two Splunk indexes: Per-use-case filtering lives in Cribl Stream pipelines downstream of this Edge install, not in the pack itself. That includes security event extraction, performance triage, and alerting rules.

​
Install

A new Mac joins the telemetry fleet by:
  1. Bringing up the standalone Cribl Edge install via nix-darwin (handled by the macOS host config; not Mintlify’s concern).
  2. The same nix-darwin activation installs the pinned pack version from the repo’s release artifact. No Leader, no heartbeat push, no per-host install command. The host config is the whole deployment.
Upgrades are GitOps: bump the pinned pack version in the nix-darwin config, rebuild, done. For one-off testing outside the Nix-managed path, the pack ships a .crbl artifact installable via Cribl’s REST API. See the repo README for that path.
This page documents how the Mac Pack is deployed in this homelab. The pack itself, including Sources, predicates, anomaly detection rules, and override patterns, is documented in its own repo.

orbstack-kubernetes

The K8s cluster — runs unrelated Cribl Edge instances. This pack does not target that cluster.

Monitoring agents

Cross-stack view of every collector and where it runs.

Source on GitHub

The pack itself: every Source, every input, anomaly-detection rules, override patterns, release notes.