diff --git a/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml b/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml index 363bd4a275..4233b62a8c 100644 --- a/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml +++ b/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml @@ -677,8 +677,6 @@ spec: tags: compliance, ssh, built-in contributors: GuillaumeRoss platform: darwin,linux,windows - contributors: GuillaumeRoss - --- apiVersion: v1 kind: policy @@ -690,3 +688,27 @@ spec: platforms: Windows tags: malware, hunting contributors: kswagler-rh +--- +apiVersion: v1 +kind: policy +spec: + name: Firewall enabled (macOS) + query: SELECT 1 FROM alf WHERE global_state >= 1; + description: "Checks if the firewall is enabled." + resolution: "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall." + platforms: macOS + tags: hardening, compliance, built-in + platform: darwin + contributors: GuillaumeRoss +--- +apiVersion: v1 +kind: policy +spec: + name: Screen lock enabled via MDM profile (macOS) + query: SELECT 1 FROM managed_policies WHERE name='askForPassword' AND value='1'; + description: "Checks that a MDM profile configures the screen lock." + resolution: "Contact your IT administrator to help you enroll your computer in your organization's MDM. If already enrolled, ask your IT administrator to enable the screen lock feature in the profile configuration." + platforms: macOS + tags: compliance, hardening, built-in + platform: darwin + contributors: GuillaumeRoss diff --git a/frontend/utilities/constants.ts b/frontend/utilities/constants.ts index 7faf7db1fd..adb1a9c3b1 100644 --- a/frontend/utilities/constants.ts +++ b/frontend/utilities/constants.ts @@ -140,6 +140,25 @@ export const DEFAULT_POLICIES = [ "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", platform: "darwin", }, + { + key: 13, + query: "SELECT 1 FROM alf WHERE global_state >= 1;", + name: "Firewall enabled (macOS)", + description: "Checks if the firewall is enabled.", + resolution: + "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall.", + platform: "darwin", + }, + { + key: 14, + query: + "SELECT 1 FROM managed_policies WHERE name='askForPassword' AND value='1';", + name: "Screen lock enabled via MDM profile (macOS)", + description: "Checks that a MDM profile configures the screen lock", + resolution: + "Contact your IT administrator to help you enroll your computer in your organization's MDM. If already enrolled, ask your IT administrator to enable the screen lock feature in the profile configuration.", + platform: "darwin", + }, ] as IPolicyNew[]; export const FREQUENCY_DROPDOWN_OPTIONS = [