Audit Results
View, filter, edit, and understand your compliance audit results.
Every rule's status, what was checked, and what was found.
Results Overview
After an audit completes, you see a comprehensive view of your Mac's compliance status. The results screen has three main areas:
Pass rate, status counts, and filter controls at the top of the window.
Every rule with its status and details, searchable and sortable.
Deep dive into the selected rule — scripts, discussion, outputs, and editing controls.
Summary Statistics
At the top of the results view, you'll see:
Your main compliance score. Shows what percentage of rules passed out of all the rules that could be automatically checked.
N/A and Manual Review rules don't count toward this number.
Color-coded counts for each status type. Click a badge to filter the table to just that status.
Results Table
The main table shows every rule that was checked:
Table Columns
| 🚦 | Status | Color-coded badge, e.g. Pass Fail |
| 🔢 | Rule ID / STIG ID | The unique identifier for this rule. For STIG compliance this shows the STIG ID (like APPL-15-005001); other baselines show the rule ID |
| 📝 | Title | Human-readable name describing what the rule checks (e.g., "Enable Firewall Logging") |
| 📁 | Section | The category this rule belongs to (e.g., "System Settings", "Authentication") |
| ✅ | Expected Output | What the check command should return for a passing result — the "correct" value |
| 📋 | Actual Output | What your Mac actually returned. If this matches Expected, the rule passes |
| ⏱️ | Execution Time | How long the check took to run (in seconds). Helps identify slow-running checks |
Optional Columns
Depending on your baseline and settings, you may also see:
| 🔖 | CIS ID | CIS Benchmark reference number (for CIS compliance) |
| 📖 | Discussion | Additional context about the rule |
Filtering and Searching
Click the status badges to filter the table:
- Click Failed to see only failed rules
- Click Passed to see only passing rules
- Click Manual Review to see rules needing attention
- Click All to reset and show everything
Use the search box to find rules by:
- Rule ID: Search "firewall" to find firewall-related rules
- Title: Search by the rule name
- Section: Search by category name
Click column headers to sort:
- Rule ID: Alphabetical by identifier
- STIG ID: By STIG reference (STIG compliance only)
- Title: Alphabetical by name
- Status: Groups by status (failures first)
Rule Details Panel
Click any rule to see its full details in the right panel:
The command that was run to check this setting. Shows exactly what MACE tested.
The remediation command that would fix a failing rule. Copy this to run manually, or use Build to generate scripts that include it.
Detailed explanation of why this rule exists, what it protects against, and any context for the setting.
If the check failed with an error, this shows what went wrong. Helps troubleshoot issues.
Click to copy the rule's ID to your clipboard. Useful for referencing specific rules in documentation or reports.
Editing Results
Overriding Status
Sometimes you need to manually change a rule's status. For example:
| ✅ | False failure | A check reports "Fail" but you've verified it's actually compliant via a different method |
| ❌ | False pass | A check reports "Pass" but you know there's an issue |
| 👁️ | Manual review done | You've completed a manual review and need to set the status |
Overrides Are Tracked
When you override a result, MACE remembers the original value. Exports can show an "Override" indicator so auditors know which results were manually changed.
Editing Expected and Actual Output
You can also edit the Expected Output and Actual Output fields — click the field, modify the text, and the change is tracked as an override.
This is useful when:
| 🧹 | Messy output | The check returned extra whitespace or formatting |
| 👀 | Manual observation | You need to document what you manually observed |
| 🎯 | Environment-specific value | You want to correct an expected value for your environment |
Adding Comments
Comments let you document why a rule is in a particular state. Select a rule, find the Comment field in the details panel, and enter your notes.
| 🚫 | Exemptions | Explain why a rule is exempt from your baseline |
| 🛡️ | Compensating controls | Document alternative protections that cover the risk |
| 📅 | Remediation plans | Note when a fix is scheduled or planned |
| ✍️ | Verification records | Record who verified a manual review item and how |
Comments Travel With Your Reports
Comments appear in every exported format — from PDF reports to STIG checklists — so your documentation stays with the results auditors see.
Re-running Rules
After making changes to your Mac, re-check one rule without running the entire audit: select the rule, then click Re-run (or right-click and select Re-run). The rule is checked again and the result updates.
Click Re-run All in the toolbar to check every rule fresh. User comments are preserved, but statuses are updated.
Understanding Pass/Fail
A rule passes when the Actual Output matches the Expected Output:
| Pass | Expected: 1 · Actual: 1 | The check ran and the value matches — firewall is enabled as required |
| Fail | Expected: 1 · Actual: 0 | The check ran successfully but the value was wrong — firewall is disabled |
| Error | Check couldn't run | The check itself crashed, timed out, or returned unexpected output — investigate why |
Error vs Fail
Fail means the check ran and gave a definitive wrong answer. Error means the check never completed, so the true state is unknown — review errors before addressing failures.
Working with Manual Review Items
Rules marked Manual Review have no automated check. You must:
Identifying Problem Areas
Failed Rules
Failed rules are your immediate priority. For each failed rule:
Section Breakdown
Tip: Compliance by Category
Enable Section Summary in export options to see compliance broken down by category. This helps identify which areas of your baseline have the most failures — for example, most misses concentrated in "Authentication" or "System Settings".
Best Practices
Add comments to any rule with exceptions, compensating controls, or special circumstances. This helps auditors understand your decisions.
Error results mean something went wrong with the check itself. Investigate these before addressing failures.
Don't leave rules in "Manual Review" status. Verify each one and set a definitive status with documentation.
Export results before remediating so you have a record of the "before" state for comparison.
What's Next?
| 📄 | Exporting Reports | Live preview and export in nine formats, from PDF to DISA STIG checklists |