Splunk and macOS Auditing
To verify that macOS auditing is enabled and functioning correctly, you can use Splunk to search for specific audit logs that macOS generates. macOS uses the OpenBSM audit framework, which…
Ensure Security Auditing Is Enabled
Enable Auditing $ /usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist Read Auditing Setting LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") if [[ $LAUNCHD_RUNNING == 1 ]] &&…
Common Platform Enumeration (CPE)
Common Platform Enumeration (CPE) is a structured naming scheme for information technology (IT) systems, software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a…