Add Cortex XDR macOS telemetry mappings — 47 sub-categories

[malwr4n6]

Description

This PR adds Palo Alto Cortex XDR telemetry mappings for macOS across 47 sub-categories, verified via the EDR Telemetry test script and direct Cortex XDR cloud console log export.

Environment Details

• Operating System: Apple macOS Tahoe (26.5.1)
• Architecture: Apple Silicon (ARM64)
• Vendor/Sensor: Palo Alto Networks Cortex XDR Agent
• Agent Version: 9.0.0.6334
• Content Version: 2320-38124
• Policy: macOS Default

Evidence will be shared privately with the maintainer on request.

Sub-Categories Updated (47)

Category	Sub-Categories
Process Activity	Process Creation, Process Termination
File Activity	File Creation, File Modification, File Deletion, File Attribute Change, File Open/Access
User & Session Activity	User Logon, User Logoff, Privilege Escalation (sudo etc.)
Script Activity	Script Content
Network Activity	Network Connection, Network Socket Listen, DNS Query
Scheduled Task & Persistence Activity	Scheduled Task Change (cron/at), Launchd Item Created, Launchd Item Modified, Launchd Item Deleted, LoginItem Created, LoginItem Deleted
User Account Activity	User Account Created, User Account Modified, User Account Deleted
System Extension & Driver Activity	System Extension Installed, System Extension Loaded, System Extension Uninstalled, Kernel Extension Loaded (legacy)
Code Signing & Trust Activity	Binary Signature Info Recorded, Notarization Status Recorded, Quarantine Flag Set, Quarantine Flag Cleared, Gatekeeper Decision Logged
Privacy & TCC Activity	TCC Prompt Shown, TCC Decision (Allow), TCC Decision (Deny), TCC Policy Change, TCC Access Check
Access Activity	Raw Device Access, Process Access
Process Tampering Activity	Process Injection Or Tampering
Device Activity	External Media Mounted, External Media Unmounted
File Metadata	MD5 Available, SHA-256 Available
Service Activity	Service Created, Service Modified, Service Deleted

Not Yet Confirmed (left empty)

Logon Failed, Screen Lock, Screen Unlock, Group Membership Modified, DriverKit Extension Loaded, XProtect Detection Logged, XProtect Remediation Logged, Agent Start, Agent Stop, Agent Protection Disabled or Tamper Event, Fuzzy Hash Available.