TMA-MACOS-3.1

Ensure Security Auditing Is Enabled

ВисокаНиво 1Аутоматскаmacos

Опис

macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log. Apple has deprecated auditd as of macOS 11.0 Big Sur. In macOS 14.0 Sonoma it is no longer enabled by default and it is suggested to use an application that integrates with the EndpointSecurity API.

Како се проверава

Метод провере: Команда љуске

shell

out=$(/bin/launchctl list 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -qi com.apple.auditd && echo compliant

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Terminal: sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist ; sudo /bin/cp /etc/security/audit_control.example /etc/security/audit_control.

Својства

Оперативни системи: macos-26
Ознаке: macoslogging-auditing
Референца: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.1 Ensure Security Auditing Is Enabled

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target macos