STIGQter: STIG Summary: Nutanix Acropolis Application Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix Cluster Check (NCC) must be configured to provide alerts to the system administrator (SA) and information system security officer (ISSO), immediately when audit storage reaches 75 percent capacity.

DISA Rule

SV-279425r1192580_rule

Vulnerability Number

V-279425

Group Title

SRG-APP-000359-AS-000065

Rule Version

NXAC-AS-000016

Severity

CAT II

CCI(s)

• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

10

Fix Recommendation

Enable the NCC "CVM DISK | System Audit Volume Usage", set the threshold values, and verify an alert is sent when the disk capacity reaches or exceeds 75 percent.

1. Log in to Prism Element.
2. Select "Health" from the navigation drop-down.
3. Select Actions >> Manage Checks.
4. Scroll to :CVM | Disk" section, then select "System Audit Volume Usage".
5. If check is disabled, click to enable the check.
6. Select "Alert Policy", then set the values for "Warning" and "Critical" thresholds to 75 percent and click "Save".

Configure NCC within Prism Element to send an alert and emails for ISSO and SA.

1. On the Actions tab, select "Set NCC Frequency".
2. Enter frequency timeframe.
3. Enter recipient email address(es).

Check Contents

Confirm the NCC "CVM DISK | System Audit Volume Usage" is enabled and an alert is sent when the disk capacity reaches or exceeds 75 percent.

1. Log in to Prism Element.
2. Select "Health dashboard" from the navigation drop-down.
3. Select Actions >> Manage Checks.
4. Scroll to CVM | Disk section, and then select "System Audit Volume Usage".
5. Validate the Alert Policy settings for "Warning and Critical" are set to 75 percent.

Confirm Nutanix AOS is set to send SMTP alerts to the email address(es) for the ISSO and SA, at a minimum.

1. Log in to Prism Element.
2. Select the "Health" dashboard.
3. On the "Actions" tab, review the setting for "Set NCC Frequency".

If NCC alert settings are not configured as required, this is a finding.

Vulnerability Number

V-279425

Documentable

False

Rule Version

NXAC-AS-000016

Severity Override Guidance

Confirm the NCC "CVM DISK | System Audit Volume Usage" is enabled and an alert is sent when the disk capacity reaches or exceeds 75 percent.

1. Log in to Prism Element.
2. Select "Health dashboard" from the navigation drop-down.
3. Select Actions >> Manage Checks.
4. Scroll to CVM | Disk section, and then select "System Audit Volume Usage".
5. Validate the Alert Policy settings for "Warning and Critical" are set to 75 percent.

Confirm Nutanix AOS is set to send SMTP alerts to the email address(es) for the ISSO and SA, at a minimum.

1. Log in to Prism Element.
2. Select the "Health" dashboard.
3. On the "Actions" tab, review the setting for "Set NCC Frequency".

If NCC alert settings are not configured as required, this is a finding.

Check Content Reference

M

Target Key

5729