Splunk and macOS Auditing
To verify that macOS auditing is enabled and functioning correctly, you can use Splunk to search for specific audit logs that macOS generates. macOS uses the OpenBSM audit framework, which…
Ensure Security Auditing Is Enabled
Enable Auditing $ /usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist Read Auditing Setting LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") if [[ $LAUNCHD_RUNNING == 1 ]] &&…
Developing Your Mac Compliance Strategy Generating Baselines and Guidance
The Apple Deployment and Management exam doesn’t test you on the learning objectives covered in this tutorial. Link: https://it-training.apple.com/tutorials/deployment/sec020
Enforce Multifactor Authentication for Login
6.1. Enforce Multifactor Authentication for Login The system MUST be configured to enforce multifactor authentication. All users MUST go through multifactor authentication to prevent unauthenticated access and potential compromise to…