Who Did What, When, and How: Introducing Auditing in Nutanix Database Service

Databases hold an organization's most sensitive data — and in regulated industries, every action taken on database infrastructure needs to be accounted for. Security teams need to answer questions like: Who provisioned that database? Who deleted that snapshot? When was that user's role changed — and by whom?

With Nutanix Database Service (NDB) 2.11, answering those questions is now built in. We're excited to announce the general availability of Auditing in NDB — a native capability that captures a structured audit trail of user actions across your database fleet and delivers it into the security and compliance workflows you already use.

Why Audit Trails Are Non-Negotiable

Compliance frameworks such as PCI-DSS, HIPAA, ISO 27001, SOC 2, and DORA mandate detailed audit trails of user and system activity. For enterprises in financial services, healthcare, and government, this isn't optional — it's a gating requirement for production deployments.

Until now, organizations that needed this visibility had to work around the gap: piecing together operation histories from different sources, manually reconciling logs during audits, and accepting blind spots during security investigations. That approach is time-consuming, error-prone, and increases audit risk.

What's New: Native Auditing in NDB

NDB Auditing records user-initiated action performed through the NDB Console, API, or CLI — capturing who did what, when, from where, and with what outcome. NDB Auditing focuses on control-plane activity — every action taken to manage your databases through NDB.

Each audit record includes:

• User identity — username and unique user ID
• Action details — the operation performed and the entity it targeted (databases, clones, snapshots, profiles, users, roles, and more)
• Source information — the client IP where the request originated
• Outcome — whether the operation succeeded or failed
• Timestamps — when the action occurred

Coverage spans the full breadth of NDB operations: database lifecycle actions (provision, clone, patch, delete), snapshot and Time Machine operations, profile management, user and access management, and configuration changes — including changes to the auditing configuration itself.

Seamless Integration with Prism Central and Your SIEM

NDB Auditing is delivered through deep integration with Nutanix Prism Central, giving you a consistent audit experience across your Nutanix environment:

• Centralized visibility — NDB audit logs flow into Prism Central's Audit Explorer, where administrators can view, search, and filter them alongside audit events from other Nutanix services. Each NDB entry is clearly tagged with the originating NDB instance name, making it easy to filter logs in environments with multiple NDB deployments.
• SIEM forwarding — Using Prism Central's syslog integration, audit logs can be forwarded to your existing SIEM and log management platforms — such as Splunk, IBM QRadar, and Datadog — for centralized monitoring, correlation, long-term retention, and compliance reporting.
• One configuration, all services — If you've already configured syslog forwarding in Prism Central, NDB audit logs ride the same pipeline. No new agents, no custom scripts, no parallel infrastructure.

Long-term retention is governed downstream: Prism Central retains audit logs per its retention settings, and your SIEM or log management platform applies your organization's own retention policies — giving you comprehensive control over how long audit records are kept for compliance purposes.

PC Audit Explorer filtered to Entity Affected: NDB, showing database lifecycle actions such as "User admin requested to provision a new database" and "User admin requested to create snapshot for time machine"

Designed to Minimize Disruption

Auditing is only valuable if it's reliable — and invisible to your operations. NDB Auditing was engineered with both in mind:

• Designed for minimal impact on API response times. Audit capture is fully asynchronous — user operations never wait on audit processing.
• Built for reliability. Audit events are held in a persistent queue within NDB that survives restarts. If Prism Central is temporarily unreachable, events are retained and retried automatically with backoff.
• Helps protect sensitive data Fields such as passwords, API keys, and tokens are sanitized before audit records are stored or forwarded.
• Access is controlled. Auditing configuration is protected by a dedicated privilege, granted to super admins by default and assignable to custom roles — so you can delegate audit administration without handing over full admin rights.

Getting Started

Enabling auditing takes just a few steps:

• Navigate to Settings → Audits in the NDB console
• Select a registered Prism Central (pc.2024.3 or later) as the destination for audit logs — NDB automatically shows the syslog servers already configured in that Prism Central, so you can confirm where your logs will end up before you turn anything on
• Click Enable

That's it. From that point on, every user action in NDB is captured and delivered to Prism Central, where it's immediately visible in PC's Audit Explorer.

[The Audits page in NDB — selecting a registered Prism Central automatically surfaces its configured syslog servers, so you can confirm where logs will be forwarded before enabling auditing.]

To forward logs to your SIEM:

NDB doesn't require a separate syslog setup. As shown above, the Audits page displays the syslog servers already configured in your selected Prism Central — if Prism Central is forwarding to your SIEM or log management platform, NDB audit events ride that same pipeline automatically. To add or change syslog servers, use the Manage Syslog Servers in Prism Central link — a one-time setup that applies across all Nutanix services, not just NDB.

Why It Matters

For security teams, NDB Auditing accelerates incident investigations with a clear, queryable record of administrative activity. For compliance officers, it turns audit preparation from a manual log-hunting exercise into a standard SIEM query. This capability was shaped directly by feedback from enterprise customers in regulated industries — and with this release, NDB provides the tools to support customer efforts to meet these requirements.

Learn More

• Review the NDB documentation for detailed configuration guidance and the audit log field reference for parsing NDB events in your SIEM
• Contact your Nutanix account team to see NDB Auditing in action

Nutanix Database Service simplifies database management across hybrid multicloud environments, supporting Oracle, Microsoft SQL Server, PostgreSQL, MySQL, and MongoDB. Learn more at nutanix.com/ndb.