Command-line telemetry is the collection of logs and behavioral signals from terminal, shell, or script activity. It can include executed commands, process launches, arguments, parent-child process relationships, paste events, file writes, and network connections started from the command line. On macOS and other platforms, this data helps defenders see what happened after a user opened Terminal or a script ran.
It matters because many modern attacks do not begin with a software exploit. Instead, they rely on social engineering to make a user paste or run attacker-supplied commands. Command-line telemetry can reveal suspicious patterns such as encoded commands, unexpected downloaders, archive extraction, privilege checks, or repeated access to sensitive directories. Security teams use it to spot malicious execution, investigate what ran, and distinguish normal admin work from abuse. In defense, good terminal visibility can turn a brief user mistake into a detectable event.