← Back to Nutanix AOS 5.20.x OS Security Technical Implementation Guide

V-254169

CAT II (Medium)

Nutanix AOS must produce audit records containing information to establish the identity of any individual or process associated with the event.

Rule ID

SV-254169r991556_rule

STIG

Nutanix AOS 5.20.x OS Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001487

Discussion

Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.

Check Content

Confirm Nutanix AOS produces audit records containing information to establish when (date and time) the events occurred.

Determine if auditing is active by issuing the following command:

$ sudo systemctl is-active auditd.service
active

If the "auditd" status is not active, this is a finding.

Fix Text

Configure the audit service to be active and start automatically with the system at startup. The Audit service is protected and restricted to allow access or modifications only from the root account.

$ sudo su -
# systemctl start auditd.service