Ensure Security Auditing Logs Are Retained for 30 Days

SedangLevel 1Otomatismacos

Deskripsi

The macOS audit capability contains important information to investigate security or operational issues. This resource is only completely useful if it is retained long enough to allow technical staff to find the root cause of anomalies in the records. Retention can be set to respect both size and longevity. Audit: Requires a day-based expire-after value of at least 30d.

Cara pemeriksaan

Metode audit: Perintah shell

shell

l=$(/usr/bin/grep -e "^expire-after" /etc/security/audit_control 2>/dev/null) || exit 1
d=$(printf '%s' "$l" | /usr/bin/grep -oE '[0-9]+d' | /usr/bin/head -1 | /usr/bin/tr -d d)
if [ -n "$d" ] && [ "$d" -ge 30 ]; then echo compliant; else echo "$l"; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Terminal: Edit the /etc/security/audit_control file so that expire-after: is at least 30d

Properti

Sistem operasi: macos-15
Tag: macoslogging-auditing
Referensi: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 3.4 Ensure Security Auditing Logs Are Retained for 30 Days

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target macos