Confirm Nutanix AOS generates audit records on all successful/unsuccessful attempts to access privileges occur.
$ sudo grep -iw truncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.
$ sudo grep -iw ftruncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid=0 -k access.
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid=0 -k access.
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access.
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.