Is anyone familiar with MacOS from a syslog and event ID correlation point of view?

We recently got in some various MAC machines (IMAC, Minis and soon to add IPads) and I am unable to find anything via [apple.com](https://apple.com) from a cyber-security or defense prospective on how correctly setup to monitor these. So I am struggling on getting my syslogs to send over good readable data to my SIEM as well as how to turn off features within MacOS. I have also attempted to call their customer support but it seems that can only help …

correlation cybersecurity event id macos