gensecaihq/wazuh-autopilot/wazuh-sca-hardening

Wazuh SCA Hardening

Wazuh SCA runs policy files (mostly CIS Benchmarks: cis_ubuntu22-04, cis_win2022, cis_rhel9, …) on each agent and reports each check as passed, failed or not applicable, plus an overall score.

SCA rules (stock ruleset, group sca)

A regression (rule 19011) is the most important SCA signal: something that was compliant stopped being compliant. It can mean drift, a bad change — or an attacker weakening a host (disabling auditing, enabling root SSH login). Treat regressions on servers as potential incidents, not just hygiene.

Key fields

sca.policy, sca.policy_id, sca.check.id, sca.check.title, sca.check.result, sca.check.previous_result, sca.check.rationale, sca.check.remediation, sca.check.compliance.* (CIS, PCI DSS, NIST 800-53, HIPAA, ISO mappings shipped in the policy), sca.score, sca.passed, sca.failed.

Getting the data

• Current state: get_sca_policy_checks agent_id="<id>" (optionally policy_id) — returns checks with

result, rationale and remediation.

• Changes over time: get_wazuh_alerts rule_groups=["sca"] agent_id="<id>" timestamp_start="now-7d";

regressions only: filter the rule_id parameter on rule 19011.

• Fleet view: iterate agents from get_wazuh_agents status="active" — keep it to the in-scope set

(servers, internet-facing, crown jewels) to stay within budget.

Prioritizing failed checks

Score each failed check, highest first:

1. Exposure: internet-facing or crown-jewel host > internal server > workstation.
2. Attack relevance: checks that directly enable known techniques — remote root login, password

authentication on SSH, SMBv1, missing audit logging, world-writable system paths, no host firewall, unpatched auto-update disabled.

1. CIS profile: Level 1 checks are baseline and cheap; Level 2 checks are defence-in-depth.
2. Correlation: a failed check on a host that also has related alerts or critical vulnerabilities

moves to the top (hand off vulnerability context to vuln-management if you are compliance).

1. Effort: note likely breakage (e.g. disabling a service in use).

Mapping to frameworks

Prefer the mapping shipped in sca.check.compliance.* when present; the table is a fallback.

Remediation hand-off

SCA findings are fixed by system owners, not by Wazuh active response. Record remediation as a recommendation: check ID, title, affected agents, remediation text from the policy, and the priority. Regressions that look deliberate on a sensitive host go to triage as a new case.

Output

• add_finding per host or per theme: score, failed check count, top failed checks with remediation,

regressions with timestamps, and refs such as CIS-v8.1:4, PCI-DSS-4:Req 2, ISO-27001:A.8.9.

• save_report (kind compliance) for fleet reviews: score distribution, worst hosts, top recurring

failures, regressions since last review.