Detections
Analytics

1.48 APPL-15-001029

Information

The macOS system must configure audit retention to seven days.

GROUP ID: V-268467
RULE ID: SV-268467r1034341

The audit service must be configured to require that records be kept for an organizational-defined value before deletion unless the system uses a central audit record storage facility.

When "expire-after" is set to "7d", the audit service will not delete audit logs until the log data criteria is met.

Solution

Configure the macOS system to set audit retention to seven days with the following command:

/usr/bin/sed -i.bak 's/^expire-after.*/expire-after:7d/' /etc/security/audit_control; /usr/sbin/audit -s

See Also

https://workbench.cisecurity.org/benchmarks/23761

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CCI|CCI-001849, Rule-ID|SV-268467r1034341_rule, STIG-ID|APPL-15-001029, Vuln-ID|V-268467

Plugin: Unix

Control ID: ee506ce4a9748f898886f726a9e78701ac918a62587891082368b35117f1245d