General Information
Preference Documentation
Log Data Documentation
- Log Data Examples
- Interesting Types of Events
  - SSH Logins and Activity
Related Tech and Configurations
- macOS
Compliance
- cmdReporter and US Govt Standards Details
  - How cmdReporter Meets CMMC, DFARS, and NIST 800-171 Requirements
  - NIST 800-53r4 (high) controls met by using cmdReporter
- Security Baseline Reporting Preferences
  - Security Benchmark Reporting Logs

cmdReporter TCC Profile (example)

Daniel Griggs

Modified on: Fri, 31 Jul, 2020 at 12:35 PM

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadDescription</key>
      <string>cmdReporter-TCC-profile</string>
      <key>PayloadDisplayName</key>
      <string>cmdReporter-TCC-profile</string>
      <key>PayloadIdentifier</key>
      <string>B3485AD0-F6E4-4FE1-A750-61FCF8A421A3</string>
      <key>PayloadOrganization</key>
      <string>cmdSecurity</string>
      <key>PayloadType</key>
      <string>com.apple.TCC.configuration-profile-policy</string>
      <key>PayloadUUID</key>
      <string>E7CE5040-9AFC-49F0-96E2-0A1106BD54DC</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>Services</key>
      <dict>
        <key>SystemPolicyAllFiles</key>
        <array>
          <dict>
            <key>Allowed</key>
            <true/>
            <key>CodeRequirement</key>
            <string>anchor apple generic and identifier "com.cmdsec.cmdreporter" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "26HM594V7Q")</string>
            <key>Comment</key>
            <string></string>
            <key>Identifier</key>
            <string>com.cmdsec.cmdreporter</string>
            <key>IdentifierType</key>
            <string>bundleID</string>
          </dict>
        </array>
        <key>SystemPolicySysAdminFiles</key>
        <array>
          <dict>
            <key>Allowed</key>
            <true/>
            <key>CodeRequirement</key>
            <string>anchor apple generic and identifier "com.cmdsec.cmdreporter" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "26HM594V7Q")</string>
            <key>Comment</key>
            <string></string>
            <key>Identifier</key>
            <string>com.cmdsec.cmdreporter</string>
            <key>IdentifierType</key>
            <string>bundleID</string>
          </dict>
        </array>
      </dict>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>cmdReporter-TCC-profile</string>
  <key>PayloadDisplayName</key>
  <string>cmdReporter-TCC-profile</string>
  <key>PayloadIdentifier</key>
  <string>B3485AD0-F6E4-4FE1-A750-61FCF8A421A3</string>
  <key>PayloadOrganization</key>
  <string>cmdSecurity</string>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>04A17B00-14E9-430C-800A-EB5F1F18B20C</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>