Policies/

Antivirus healthy

Guillaume Ross

Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.

Control

Create or edit a configuration profile with the following information:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>ConfigDataInstall</key>
      <true/>
      <key>CriticalUpdateInstall</key>
      <true/>
      <key>PayloadDisplayName</key>
      <string>Software Update</string>
      <key>PayloadIdentifier</key>
      <string>com.apple.SoftwareUpdate.C0292C9C-7506-4A51-9C19-52FF2DB632EC</string>
      <key>PayloadType</key>
      <string>com.apple.SoftwareUpdate</string>
      <key>PayloadUUID</key>
      <string>C0292C9C-7506-4A51-9C19-52FF2DB632EC</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Enable automatic system data files and security updates</string>
  <key>PayloadIdentifier</key>
  <string>com.fleetdm.enableSystemDataFilesAndSecurityUpdates.1C24BCAF-E18D-434B-B5D2-70F886F19912</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>1C24BCAF-E18D-434B-B5D2-70F886F19912</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Create or edit the following script and configure it to run when the check fails:

Check

Use the policy below to verify:

Query PowerShellNEW BashNEW

SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;

x=$(/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist" 2>/dev/null); m=$(/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist" 2>/dev/null); if [[ $x =~ ^[0-9]+$ ]] && [ "$x" -ge 2162 ] && [[ $m =~ ^[0-9]+(\.[0-9]+)?$ ]] && [ "$(echo "$m >= 1.93" | bc -l)" -eq 1 ]; then echo 1; else echo 0; fi