Version
v7.0.x
Topic
The solution explains how track or analyze the changes made to plist files on OSX?
Answer
The Bit9 Agent does not analyze or track plist drift/ changes out of the box. This is because it does not treat plist files as 'interesting' content.
To monitor and report changes on the plist file(s) a Custom Report rule can be added through the Bit9 Console:
- Navigate to Rules --> Software Rules --> Custom
- Click on Add Custom Rule and fill in the rule details.
Name and Description: Free text Status should be: Enabled Rule Type will be: File Integrity Rule Write Action will be: Report. |
In the Path or File indicate the plist files(s) you would like to track.
You may also select to exclude specific processes from this rule.