The socketfilter Firewall is what is used when the Firewall is turned on in the Security and Privacy Preference Pane. In order to appropriately monitor what access is allowed and denied, logging must be enabled.The logging level must be set to "detailed" to be useful in monitoring connection attempts that the firewall detects. Throttled login is not sufficient for examining Firewall connection attempts.In-depth log monitoring on macOS may require changes to the "Enable-Private-Data" key in SystemLogging.System to ensure more complete logging. Rationale:In order to troubleshoot the successes and failures of a Firewall, detailed logging should be enabled. Impact:Detailed logging may result in excessive storage. Remediation: Terminal Method: Run the following command to enable logging of the firewall: $ /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on Turning on log mode $ /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingopt detail Setting detail log option Note:If the Firewall settings are set through a configuration profile, then modifications cannot be done through the command line. If attempted, you will receive the messageFirewall settings cannot be modified from command line on managed Mac computers. Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableFirewall 3. The key must be set to <true> 4. The key to also include is EnableLogging 5. The key must be set to <true> 6. The key to also include is LoggingOption 7. The key must be set to <string>detail</string>

[Yes/No]

Remediation: Terminal Method: Run the following command to enable logging of the firewall: $ /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on Turning on log mode $ /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingopt detail Setting detail log option Note: If the Firewall settings are set through a configuration profile, then modifications cannot be done through the command line. If attempted, you will receive the message Firewall settings cannot be modified from command line on managed Mac computers. Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableFirewall 3. The key must be set to true 4. The key to also include is EnableLogging 5. The key must be set to true 6. The key to also include is LoggingOption 7. The key must be set to string detail /string