The Apple Tracking Policy controls which device events and security information Swif tracks on managed Macs, iPhones, and iPads. Turn on each kind of tracking separately:

Use this policy to collect evidence for investigations, review device activity, and monitor security settings.

Important: Tracking only reports. It doesn't change anything on the device. Tracking doesn't block USB devices or apps, lock or erase devices, start XProtect scans, change permissions, or fix the clock. Use the related policies and commands for those.

Device Lock Tracking and Device Wipe Tracking have no default. Turn each one on or off explicitly when you create the policy.

Records when USB devices, such as external drives or peripherals, connect to the Mac. This helps investigate when hardware was connected.

A connection event doesn't show which files were copied, or prove that data left the organization. To restrict USB devices, use the Apple USB Policy.

Swif records an event each time a device accepts a lock or erase command sent from Swif. Swif records these itself, so no agent or app is needed, and they work on Macs, iPhones, and iPads.

iPhones and iPads report location only while the user allows Swif Mobile Security location access Always. Without it, the device doesn't report its location.

Location reporting is periodic, not continuous, real-time tracking. Read each location with its timestamp.

Turn on location tracking only for devices and purposes your organization's tracking practices cover.

Reports each app the Swif agent blocks, when an Apple Application Block Policy is assigned to the same Macs.

The Application Block Policy defines which apps are blocked. This setting reports the blocks. It doesn't create a blocklist or record all app usage. See Apple Tracking Policy (App Blocking Tracking).

Periodically reads XProtect Remediator scan results from the macOS unified log, and reports:

This is monitoring only. The policy never configures or starts XProtect. A plugin name identifies the scanner that ran; it doesn't mean malware was found. See Apple: Protecting against malware in macOS.

Reports the audit log configuration for the ALC-1 control:

This is monitoring only. Permissions and ownership are never changed.

Every 30 minutes, the Swif agent checks for folders under /System/Volumes/Data/System that any user can write to, and reports them. This supports CIS macOS Benchmark recommendation 5.1.6.

This is monitoring only. Permissions are never changed.

Every 30 minutes, the Swif agent compares the Mac's clock with its time server, and reports whether the difference stays within Allowed Clock Drift (seconds). The default, 270 seconds, matches the macOS Security Compliance Project (mSCP).

If the time server can't be reached, for example because the network blocks NTP, the result is reported as not measured.

This is monitoring only. The clock is never changed. To keep Macs in sync, use the Apple Date & Time Policy.

For a pilot on company-owned devices:

These are suggestions, not product defaults. For BYOD Macs, turn on only what's needed, and explain the data collected to users.

Check the device, event time, and last check-in before reading a record.

A successful install confirms the policy arrived, not that an event has happened. Some data appears only after an event, or after the next collection.

Tracking records can include device activity, physical location, and file paths. XProtect paths may include usernames or project names, and audit log configuration can show local account and permission details.

Tell users which tracking you've turned on, restrict access to reports, and follow your organization's retention process. The policy has no retention setting, so turning off a tracking option doesn't delete data already reported.

For more information, see the Swif Privacy Policy.

This is expected. Device Lock Tracking records only lock commands sent from Swif, not users locking their own screens.

This is expected. Macs report their location about once a day.

The Mac couldn't reach its time server, for example because the network blocks NTP. Check that the Mac can reach its time server on UDP port 123.

USB tracking records connections, not file transfers. Use a data protection control if you need to detect or prevent transfers.

This is expected. Audit log, system folder permission, and clock drift tracking only report. Fix the setting separately, then check the next report.