Ensure Security Auditing Logs Are Retained for 30 Days

MediaNivel 1Automatizadamacos

Descripción

The macOS audit capability contains important information to investigate security or operational issues. This resource is only completely useful if it is retained long enough to allow technical staff to find the root cause of anomalies in the records. Retention can be set to respect both size and longevity. Audit: Requires a day-based expire-after value of at least 30d.

Cómo se verifica

Método de auditoría: Comando de shell

shell

l=$(/usr/bin/grep -e "^expire-after" /etc/security/audit_control 2>/dev/null) || exit 1
d=$(printf '%s' "$l" | /usr/bin/grep -oE '[0-9]+d' | /usr/bin/head -1 | /usr/bin/tr -d d)
if [ -n "$d" ] && [ "$d" -ge 30 ]; then echo compliant; else echo "$l"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: Edit the /etc/security/audit_control file so that expire-after: is at least 30d

Propiedades

Sistemas operativos: macos-26
Etiquetas: macoslogging-auditing
Referencia: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.4 Ensure Security Auditing Logs Are Retained for 30 Days

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos