Title

The macOS system must configure audit retention to seven days. (Cat III impact)

Discussion

The audit service must be configured to require records be kept for an organizational defined value before deletion, unless the system uses a central audit record storage facility. When "expire-after" is set to "7d", the audit service will not delete audit logs until the log data criteria is met.

Check Content

Verify the macOS system is configured audit retention to seven days with the following command: /usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control If the result is not "7d", this is a finding.

Fix Text

Configure the macOS system to set audit retention to seven days with the following command: /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:7d/' /etc/security/audit_control; /usr/sbin/audit -s

Additional Identifiers

Rule ID: SV-259467r958752_rule

Vulnerability ID: V-259467

Group Title: SRG-OS-000341-GPOS-00132

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.