STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must have the audit.x86_64 package installed.

DISA Rule

SV-279565r1192081_rule

Vulnerability Number

V-279565

Group Title

SRG-OS-000254-GPOS-00095

Rule Version

NXAC-OS-000077

Severity

CAT II

CCI(s)

CCI-001464 - Initiates session audits automatically at system start-up.
CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
CCI-001889 - Record time stamps for audit records that meet organization-defined granularity of time measurement.
CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.
CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.
CCI-003938 - Automatically generate audit records of the enforcement actions.

Weight

Fix Recommendation

1. For AOS, Files, and Prism Central, this setting is configured by default to have ownership and permission levels set correctly to meet this requirement. If these are found to be out of compliance, some corruption has taken place and the OS must be rebuilt.

2. For AHV, configure the audit service to be active and start automatically with the system at startup. The audit service is protected and restricted to allow access or modifications only from the root account.

$ sudo su -
# systemctl start auditd.service

Check Contents

1. Verify Nutanix OS is configured with the ausearch tool using the following command. The ausearch tool is a feature of the audit rpm.

$ sudo yum list installed audit
Installed Packages
audit.x86_64

2. Verify the package has not been removed using the following command.

$ sudo yum list installed audit
Installed Packages
audit.x86_64

3. Verify the package has not been disabled using the following command.

$ sudo systemctl status auditd.service
auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2024-10-11 03:16:33 UTC; 21h ago

If audit.x86_64 is not installed or is not active, this is a finding.

Nutanix OS must have the audit.x86_64 package installed.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key