Nutanix AOS must produce audit records containing information to establish the identity of any individual or process associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254169	NUTX-OS-000670	SV-254169r846595_rule		Medium

Description
Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.

STIG	Date
Nutanix AOS 5.20.x OS Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-57654r846593_chk )
Confirm Nutanix AOS produces audit records containing information to establish when (date and time) the events occurred. Determine if auditing is active by issuing the following command: $ sudo systemctl is-active auditd.service active If the "auditd" status is not active, this is a finding.

Fix Text (F-57605r846594_fix)
Configure the audit service to be active and start automatically with the system at startup. The Audit service is protected and restricted to allow access or modifications only from the root account. $ sudo su - # systemctl start auditd.service