Ensure Security Auditing Logs Are Retained for 30 Days

MoyenneNiveau 1Automatiséemacos

Description

The macOS audit capability contains important information to investigate security or operational issues. This resource is only completely useful if it is retained long enough to allow technical staff to find the root cause of anomalies in the records. Retention can be set to respect both size and longevity. Audit: Requires a day-based expire-after value of at least 30d.

Méthode de vérification

Méthode d'audit: Commande shell

shell

l=$(/usr/bin/grep -e "^expire-after" /etc/security/audit_control 2>/dev/null) || exit 1
d=$(printf '%s' "$l" | /usr/bin/grep -oE '[0-9]+d' | /usr/bin/head -1 | /usr/bin/tr -d d)
if [ -n "$d" ] && [ "$d" -ge 30 ]; then echo compliant; else echo "$l"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Terminal: Edit the /etc/security/audit_control file so that expire-after: is at least 30d

Propriétés

Systèmes d'exploitation: macos-26
Étiquettes: macoslogging-auditing
Référence: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.4 Ensure Security Auditing Logs Are Retained for 30 Days

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos