compliance script should be able to say which rules fail #174

New Issue

michael · 2026-01-19T18:29:30Z

michael commented

2026-01-19 18:29:30 +00:00

Originally created by @bernstei on GitHub.

Originally assigned to: @robertgendler on GitHub.

There is currently no nice way that I can find to tell which rules failed in a compliance scan. The compliance report (1) only lists a number. The compliance scan (2) scrolls by fast and can't be searched. Running the remediation commands (3) implicitly lists the once that it can remediate, but there are some, line filevault, that it cannot and therefore don't get listed there.

The only way I've found if defaults read /Library/Preferences/org.....audit.plist | less and then searching for finding = 1, which is not that nice. A variant of the report (1) that lists the failed tests would be helpful.

Originally created by @bernstei on GitHub. Originally assigned to: @robertgendler on GitHub. There is currently no nice way that I can find to tell which rules failed in a compliance scan. The compliance report (1) only lists a number. The compliance scan (2) scrolls by fast and can't be searched. Running the remediation commands (3) implicitly lists the once that it can remediate, but there are some, line filevault, that it cannot and therefore don't get listed there. The only way I've found if `defaults read /Library/Preferences/org.....audit.plist | less` and then searching for `finding = 1`, which is not that nice. A variant of the report (1) that lists the failed tests would be helpful.

michael closed this issue

2026-01-19 18:29:30 +00:00

michael commented

2026-01-19 18:29:30 +00:00

@robertgendler commented on GitHub:

The compliance script actually writes to unified logging as well as the /Library/Logs/$baseline_baseline.log

The /Library/Logs is JUST the last run of the compliance script.

You can run log stream --predicate 'eventMessage CONTAINS "mSCP"' or do a log show --last 5m or 1d or whatever

@robertgendler commented on GitHub: The compliance script actually writes to unified logging as well as the /Library/Logs/$baseline_baseline.log The /Library/Logs is JUST the last run of the compliance script. You can run `log stream --predicate 'eventMessage CONTAINS "mSCP"'` or do a `log show --last 5m or 1d or whatever`

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#174