TMA-MACOS-1.5

Ensure Install Security Responses and System Files Is Enabled

AltaNivel 1Automatizadamacos

Descripción

Ensure that system and security updates are installed after they are available from Apple. This setting enables definition updates for XProtect and Gatekeeper. With this setting in place, new malware and adware that Apple has added to the list of malware or untrusted software will not execute. These updates do not require reboots or end user admin rights.

Cómo se verifica

Método de auditoría: Comando de shell

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('ConfigDataInstall'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('CriticalUpdateInstall'))
  if ( pref1 == 1 && pref2 == 1 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Salida esperada: true

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Profile (preferred): com.apple.SoftwareUpdate ConfigDataInstall = <true/>; com.apple.SoftwareUpdate CriticalUpdateInstall = <true/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true. GUI: System Settings > General > Software Update > i > Set Install Security Responses and System files to enabled > Done.

Propiedades

Sistemas operativos: macos-26
Etiquetas: macossoftware-update
Referencia: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.5 Ensure Install Security Responses and System Files Is Enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos