Altiward View on GitHub
Altiward · Agent, server and console · Open source

See who holds admin on every Mac. And for how long.

Altiward checks each Mac's real admin group against recorded grants, can remove rights that outlive them, and sends the record to your SIEM. SAP Privileges handles elevation; Altiward adds oversight across the fleet.

View Altiward on GitHub Try the console locally
Admins now in the Altiward console: ten people holding admin rights, one account without a grant, each with their Mac and the time used against the time allowed. One session is open in the detail panel, elevated and verified, with its reason and timeline.
Admins now, in the Altiward console. Example data.
What Altiward adds

Know who has admin. Act on what you find.

01 · Observe

Check actual admin rights

The agent reads each Mac's admin group and checks it against recorded grants and your permanent-admin list. Unexpected membership becomes a finding for your team to investigate.

02 · Control

Choose what happens at expiry

Alert when rights outlive their grant, or configure the agent to remove them. Request an early revocation from the console; the Mac applies it when it can reach your server.

03 · Investigate

See what changed during a session

Review detected changes to local accounts, launch items, sudoers, SSH keys and remote access. Missing check-ins show where visibility has stopped.

04 · Export

Bring the record into your SIEM

Send session evidence, findings and console actions to Splunk, Microsoft Sentinel or syslog as OCSF events, and correlate them with the telemetry you already collect.

The separate check

It reads the admin group, not just the timer.

One session, from grant to removal Example data
priya.raman · C02XK0AAJGH5
  1. 1 · 14:02Admin granted. Reason: “Install the printer driver”Recorded by SAP Privileges
  2. 2 · 14:10SAP Privileges' timer stops. The agent keeps checking the admin group.Altiward agent
  3. 3 · 14:32The grant expires. The rights are still in the admin group.Altiward agent
  4. 4 · 14:34Rights removed, and the session recorded as ended by enforcement.Altiward agent

Shown with ExpiryEnforcement=enforce. The default, alert, reports the rights past expiry instead of removing them. How it works, step by step

The console

One place to see admin rights across the fleet.

The Altiward console's Overview: ten people with admin rights now, one without a grant, two things that need a look, and elevations per day over the last 30 days.
Overview. Example data.
Fleet in the Altiward console: each enrolled Mac with its last check-in, admins, macOS, agent and SAP Privileges versions. One Mac's agent is marked outdated.
Fleet. Example data.
Your infrastructure

You run it. You keep the record.

Self-hosted
You host the server, web console and Postgres database. Docker Compose files are included.
No fleet telemetry to Altiward
The console's optional update check asks GitHub for the release list. It sends no fleet data and can be turned off.
Free, with no limit on Macs
Apache License 2.0. Read what Altiward collects, stores and sends, or review the source before you deploy.
Try the console locallyGo 1.25+ · Node 22 · Docker
git clone https://github.com/Altiward/altiward
cd altiward && make console-install
make run-api
# then, in a second terminal
make console-seed && make console-dev
# open http://localhost:5173 and sign in with dev-console-token-001
Read the install guide Releases

Only need SAP Privileges events in your SIEM? altiward-forwarder sends them without the agent.