---
id: os_firewall_log_enable
title: Enable Firewall Logging
discussion: |
  Firewall logging _MUST_ be enabled.

  Firewall logging ensures that malicious network activity will be logged to the system.

  NOTE: The firewall data is logged to Apple's Unified Logging with the subsystem `com.apple.alf` and the data is marked as private. In order to enable private data, review the `com.apple.alf.private_data.mobileconfig` file in the project's `includes` folder.
references:
  nist:
    cce:
      macos_14:
        - CCE-92793-9
    800-53r5:
      - AU-12
      - SC-7
    800-171r3:
      - 03.03.03
      - 03.13.01
  disa:
    cmmc:
      - AU.L2-3.3.6
      - SC.L1-3.13.1
  cis:
    benchmark:
      macos_14:
        - 3.6 (level 1)
    controls_v8:
      - 4.5
      - 8.2
      - 8.5
platforms:
  macOS:
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          function run() {
            let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\
            .objectForKey('EnableLogging').js
            let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\
            .objectForKey('LoggingOption').js
            if ( pref1 == true && pref2 == "detail" ){
              return("true")
            } else {
              return("false")
            }
          }
          EOS
        result:
          string: 'true'
    introduced: '12.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_moderate
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
mobileconfig_info:
  - PayloadType: com.apple.security.firewall
    PayloadContent:
      - EnableLogging: true
      - LoggingOption: detail
