Level Verified

macOS Monitor - Firewall Script

Checks the firewall status on macOS systems and alerts if it’s disabled. Ideal for script-based monitoring in Level and automated security remediation workflows.

Import into Level

Problem overview

A disabled firewall on macOS can leave endpoints vulnerable to unauthorized network access and malicious traffic, especially when devices operate outside secure corporate environments. Detecting this issue proactively helps maintain a stronger security posture and reduces the chance of breaches.

Bash 100s timeout Runs as Local system macOS 
#!/bin/bash

# This resource is provided as a convenience for Level users. We cannot 
# guarantee it will work in all environments. Please test before deploying 
# to your production environment. We welcome contributions to our community 
# library

# Level Library
# https://level.io/library/script-macos-monitor-firewall

# Get the status of the firewall
FIREWALL_STATUS=$(sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate)

# Check if the firewall is enabled
if [[ "$FIREWALL_STATUS" == *"Firewall is enabled"* ]]; then
  echo "SUCCESS: Firewall is enabled."
  exit 0
else
  echo "ALERT: Firewall is disabled."
  exit 1
fi

This script uses the built-in socketfilterfw command to retrieve the firewall’s status on a macOS endpoint. If it’s enabled, the script reports success, and if it’s disabled, it raises an alert for immediate attention. You can set it up as a script-based monitor in Level so that you’re notified whenever the firewall is found to be off.

You can also integrate it into a scheduled Automation in Level, running periodic checks to enforce consistent security standards across your macOS fleet, ensuring no device remains unprotected.

Use cases

  • Monitoring critical workstations or servers for disabled firewalls
  • Ensuring compliance with organizational security requirements
  • Detecting user-initiated or accidental firewall disablement
  • Proactively safeguarding remote or mobile macOS devices

Recommendations

  • Test the script on a sample device to confirm firewall checks work as intended
  • Use a script-based monitor in Level to receive real-time notifications
  • Schedule periodic scans with a Level Automation for comprehensive coverage
  • Consider automatic remediation if the firewall is disabled, such as re-enabling it via a separate script
  • Keep logs of alerts to spot trends or repeated disablement

Frequently asked questions.

How do I integrate this script in Level?

Import it as a resource, then configure a script-based monitor or an Automation schedule to run it.

Does this script turn the firewall on if it’s disabled?

No, it only reports status. Pair it with a remediation action if you want to enable the firewall automatically.

What permissions are required?

It runs with System or Root permissions under Level, ensuring it can query the firewall’s status without restrictions.

Does the script work on older macOS versions?

socketfilterfw is present in most modern macOS versions. Test in your specific environment to confirm compatibility.

Can I customize the alert message?

Yes, edit the echo statements within the script to suit your logging or notification preferences.

Ready when you are.

No credit card. No sales call. Just sign up and start managing.

Start for free Talk to us