STIGQter STIGQter: STIG Summary: Apple macOS 11 (Big Sur) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The macOS system must allocate audit record storage capacity to store at least one week's worth of audit records when audit records are not immediately sent to a central audit record storage facility.

DISA Rule

SV-230781r599842_rule

Vulnerability Number

V-230781

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

APPL-11-001029

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit the "/etc/security/audit_control" file and change the value for "expire-after" to the amount of time audit logs should be kept for the system. Use the following command to set the "expire-after" value to "7d":

/usr/bin/sudo /usr/bin/sed -i.bak 's/.*expire-after.*/expire-after:7d/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Check Contents

The check displays the amount of time the audit system is configured to retain audit log files. The audit system will not delete logs until the specified condition has been met. To view the current setting, run the following command:

/usr/bin/sudo /usr/bin/grep ^expire-after /etc/security/audit_control

If this returns no results, or does not contain "7d" or a larger value, this is a finding.

Vulnerability Number

V-230781

Documentable

False

Rule Version

APPL-11-001029

Severity Override Guidance

The check displays the amount of time the audit system is configured to retain audit log files. The audit system will not delete logs until the specified condition has been met. To view the current setting, run the following command:

/usr/bin/sudo /usr/bin/grep ^expire-after /etc/security/audit_control

If this returns no results, or does not contain "7d" or a larger value, this is a finding.

Check Content Reference

M

Target Key

5246

Comments