Ensure Security Auditing Logs Are Retained for 30 Days

MittelStufe 1Automatisiertmacos

Beschreibung

The macOS audit capability contains important information to investigate security or operational issues. This resource is only completely useful if it is retained long enough to allow technical staff to find the root cause of anomalies in the records. Retention can be set to respect both size and longevity. Audit: Requires a day-based expire-after value of at least 30d.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

l=$(/usr/bin/grep -e "^expire-after" /etc/security/audit_control 2>/dev/null) || exit 1
d=$(printf '%s' "$l" | /usr/bin/grep -oE '[0-9]+d' | /usr/bin/head -1 | /usr/bin/tr -d d)
if [ -n "$d" ] && [ "$d" -ge 30 ]; then echo compliant; else echo "$l"; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Terminal: Edit the /etc/security/audit_control file so that expire-after: is at least 30d

Eigenschaften

Betriebssysteme: macos-15
Tags: macoslogging-auditing
Referenz: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 3.4 Ensure Security Auditing Logs Are Retained for 30 Days

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target macos