Vulnerability Discussion

The audit service must be configured to require records be kept for an
organizational defined value before deletion, unless the system uses a central audit record storage
facility.

When "expire-after" is set to "7d", the audit service will not delete audit logs until the log data
criteria is met.

Check

Verify the macOS system is configured audit retention to seven days with the following
command:

/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control

If the result is not "7d", this is a finding.

Fix

Configure the macOS system to set audit retention to seven days with
the following command:

/usr/bin/sed -i.bak 's/^expire-after.*/expire-after:7d/' /etc/security/audit_control; /usr/sbin/audit -s