Nutanix AOS must produce audit records containing information to establish the source of events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254167	NUTX-OS-000650	SV-254167r846589_rule		Medium

Description
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In addition to logging where events occur within the operating system, the operating system must also generate audit records that identify sources of events. Sources of operating system events include, but are not limited to, processes, and services. To compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know the source of the event.

Description

Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In addition to logging where events occur within the operating system, the operating system must also generate audit records that identify sources of events. Sources of operating system events include, but are not limited to, processes, and services. To compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know the source of the event.

STIG	Date
Nutanix AOS 5.20.x OS Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-57652r846587_chk )
Verify the operating system produces audit records containing information to establish when (date and time) the events occurred. Determine if auditing is active by issuing the following command: $ sudo systemctl is-active auditd.service active If the "auditd" status is not active, this is a finding.

Fix Text (F-57603r846588_fix)
Enable the auditd service to run automatically. $ sudo systemctl enable auditd