Detections
Analytics
AOSX-10-000230 - The operating system must initiate session audits at system startup.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.Solution
To enable the audit service, run the following command:sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist
See Also
http://iasecontent.disa.mil/stigs/zip/U_Apple_OS_X_10-10_Workstation_V1R5_STIG.zip
Item Details
Audit Name: DISA STIG Apple Mac OSX 10.10 v1r5
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-14(1), CAT|II, CCI|CCI-001464, Rule-ID|SV-74021r1_rule, STIG-ID|AOSX-10-000230, Vuln-ID|V-59591
Plugin: Unix
Control ID: 0046b7e4198d7ec64206d668592e5bd21a6c203c47a3b6f91e19893248b8f169