Checks if the firewall is enabled.
Create or edit a configuration profile with the following information:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>EnableFirewall</key>
<true/>
<key>PayloadDisplayName</key>
<string>Firewall</string>
<key>PayloadIdentifier</key>
<string>com.apple.security.firewall.84151DEA-D0E5-4334-91D4-4BBDFA38CD17</string>
<key>PayloadType</key>
<string>com.apple.security.firewall</string>
<key>PayloadUUID</key>
<string>84151DEA-D0E5-4334-91D4-4BBDFA38CD17</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Enable Firewall</string>
<key>PayloadIdentifier</key>
<string>com.fleetdm.enablefirewall.D93BF783-383E-41CD-97AA-1D3FD71045BE</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>D93BF783-383E-41CD-97AA-1D3FD71045BE</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
Create or edit the following script and configure it to run when the check fails:
Use the policy below to verify
SELECT 1 FROM alf WHERE global_state >= 1;