Confirm Nutanix AOS generates audit records on all successful/unsuccessful attempts to access categories of information occur.
$ sudo grep -iw chown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S chown -F auid=0 -k audit_time_perm_mod_export_delete
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S chown -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
$ sudo grep -iw fchown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchown -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S fchown -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
-a exit,never -F arch=b64 -S openat -S open -S fchown -F success=0 -F uid=1000 -F exit=-13.
-a exit,never -F arch=b64 -S fchown -F success=0 -F uid=0 -F exit=-13.
$ sudo grep -iw lchown /etc/audit/audit.rules
-a always,exit -F arch=b64 -S lchown -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S lchown -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
$ sudo grep -iw fchownat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S fchownat -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S fchownat -F auid=0 -k audit_time_perm_mod_export_delete.
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k audit_time_perm_mod_export_delete.
If the output does not contain all of the above rules, this is a finding.
If both the "b32" and "b64" audit rules are not defined for the listed syscall(s), this is a finding.