TMA-MACOS-3.1
Ensure Security Auditing Is Enabled
TinggiLevel 1Otomatismacos
Deskripsi
macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log. Apple has deprecated auditd as of macOS 11.0 Big Sur. In macOS 14.0 Sonoma it is no longer enabled by default and it is suggested to use an application that integrates with the EndpointSecurity API.
Cara pemeriksaan
Metode audit: Perintah shell
shell
out=$(/bin/launchctl list 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -qi com.apple.auditd && echo compliant- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Terminal: sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist ; sudo /bin/cp /etc/security/audit_control.example /etc/security/audit_control.
Properti
- Sistem operasi
- macos-26
- Tag
- macoslogging-auditing
- Referensi
- CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.1 Ensure Security Auditing Is Enabled
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
shell
tmaegis scan --target macos