Added system_settings_improve_search_disable

rules/system_settings/system_settings_improve_search_disable.yaml

@@ -0,0 +1,70 @@
+id: system_settings_improve_search_disable
+title: Disable Sending Spotlight Search Information to Apple
+discussion: |
+  Sending data to Apple to help improve search _MUST_ be disabled.
+  
+  The information system _MUST_ be configured to provide only essential capabilities. Disabling the submission of search data will mitigate the risk of unwanted data being sent to Apple.
+check: |
+  /usr/bin/osascript -l JavaScript << EOS
+  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\
+  .objectForKey('Search Queries Data Sharing Status').js
+  EOS
+result:
+  integer: 2
+fix: |
+  This is implemented by a Configuration Profile.
+references:
+  cce:
+    - N/A
+  cci:
+    - CCI-000381
+  800-53r5:
+    - AC-20
+    - CM-7
+    - CM-7(1)
+    - SC-7(10)
+  800-53r4:
+    - CM-7
+    - CM-7(1)
+    - AC-20
+    - SC-7(10)
+  800-171r3:
+    - 03.01.20
+    - 03.04.06
+  srg:
+    - SRG-OS-000095-GPOS-00049
+  disa_stig:
+    - N/A
+  cis:
+    benchmark:
+      - N/A
+    controls v8:
+      - 4.1
+      - 4.8
+  cmmc:
+    - AC.L1-3.1.20
+    - CM.L2-3.4.6
+    - CM.L2-3.4.7
+macOS:
+  - '15.0'
+tags:
+  - 800-53r5_low
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - 800-53r4_low
+  - 800-53r4_moderate
+  - 800-53r4_high
+  - 800-171
+  - cisv8
+  - cnssi-1253_moderate
+  - cnssi-1253_low
+  - cnssi-1253_high
+  - cmmc_lvl2
+  - cmmc_lvl1
+  - stig
+  - cis_lvl1
+severity: medium
+mobileconfig: true
+mobileconfig_info:
+  com.apple.assistant.support:
+    Search Queries Data Sharing Status: 2