Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements

СредњаНиво 2Аутоматскаmacos

Опис

Auditing is the capture and maintenance of information about security-related events. Auditable events often depend on differing organizational requirements. Audit: Requires aa, ad, lo and -ex, -fm, -fr, -fw (or -all) in the flags line of /etc/security/audit_control.

Како се проверава

Метод провере: Команда љуске

shell

l=$(/usr/bin/grep -e "^flags:" /etc/security/audit_control 2>/dev/null) || exit 1
f=",$(printf '%s' "${l#flags:}" | /usr/bin/tr -d ' '),"
miss=""
for x in aa ad lo; do case "$f" in *",$x,"*) ;; *) miss="$miss $x";; esac; done
case "$f" in
  *",-all,"*|*",all,"*) ;;
  *) for x in ex fm fr fw; do case "$f" in *",-$x,"*|*",$x,"*) ;; *) miss="$miss -$x";; esac; done;;
esac
if [ -z "$miss" ]; then echo compliant; else echo "missing flags:$miss"; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Terminal: Edit the /etc/security/audit_control file and add aa, ad, -ex, -fm, -fr, -fw, and lo to flags. You can also substitute -all for -ex, -fm, -fr, and -fw.

Својства

Оперативни системи: macos-26
Ознаке: macoslogging-auditing
Референца: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.2 Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target macos --level 2