Security Monitoring, Auditing, and Compliance Reporting
Three record types, often confused
Audit logs record who changed what and when - configuration and API actions. Tasks show job progress. Alerts report health, capacity, and threshold events. Flow logs record traffic decisions. Exam items routinely swap these; a question about "proving who deleted a VM" is an audit-log question, while "proving which flows were blocked" is a Flow question.
Retention and forwarding
Local audit retention is finite, so forward logs to a SIEM via syslog - and configure forwarding on each cluster and on Prism Central, because each appliance generates its own stream. Deleting a user does not erase their historical audit entries, which is exactly what auditors want to see. Protect the syslog destination and the SIEM credentials with the same rigor as the cluster itself.
Posture and compliance
Prism Central and Nutanix's cloud-delivered posture service map cluster configuration against frameworks such as CIS benchmarks, STIG, and regulatory control sets (PCI DSS, HIPAA), producing reports and exports for auditors. A report is evidence of configuration at a point in time, not continuous proof of operation - pair it with retained logs and a review cadence.
Practical review loop
(1) Is syslog configured and tested with a real message? (2) Is there a named owner and cadence for audit review? (3) Are role changes and new Super Admin assignments alerted? (4) Are compliance scans re-run after every upgrade?
Trap
Assuming alerts are audit evidence, or that Prism Central's audit view automatically includes Prism Element activity without forwarding.