Display which test failed

[chiefbobkat]

I run the generated compliance.sh to fix issues and then rerunning the compliance scan and viewing the last scan I see that Number of tests passed: 124
Number of test FAILED: 20
Number of exempt rules: 0
You are 86.11% percent compliant!
Where can I see which test failed?

[brodjieski]

There are a couple of places to look for the results of the compliance check.

Log file that resides in /Library/Logs/<baseline-name>_baseline.log will identified checks that failed

.plist file that lives in /Library/Preferences/org.<baseline-name>.audit.plist will have "finding" set to true on checks that fail.

an example of parsing the .plist could be done like (assuming cis_lvl1 is the baseline, and assuming jq is installed):
plutil -convert json -o - /Library/Preferences/org.cis_lvl1.audit.plist | jq 'to_entries[] | select(.value.finding? == true) | .key'