| 1 | --- |
| 2 | title: SCA Policies (CIS benchmarks) |
| 3 | description: Browse, preview, and deploy CIS benchmark policies for Wazuh Security Configuration Assessment — with automatic agent detection to see which endpoints need each policy. |
| 4 | --- |
| 5 | |
| 6 | SCA Policies is a catalog of CIS benchmark policy files maintained in the public [CoPilot-SCA](https://github.com/socfortress/CoPilot-SCA) GitHub repository. It lets you browse available policies, detect which agents are running the relevant software, and get ready-to-run deployment commands — all from within CoPilot. |
| 7 | |
| 8 | These policies extend the [Wazuh Security Configuration Assessment (SCA)](https://documentation.wazuh.com/current/user-manual/capabilities/sec-config-assessment/index.html) capability. Once deployed to an agent, Wazuh evaluates the endpoint against the CIS benchmark and reports pass/fail results in the [SCA Overview](/user/ui/agents-sca-overview). |
| 9 | |
| 10 | --- |
| 11 | |
| 12 | ## What it is |
| 13 | |
| 14 | A searchable catalog of SCA policy `.yml` files that you can: |
| 15 | |
| 16 | - **Browse** by platform (Linux, Windows), application (Apache, NGINX, MySQL, etc.), and CIS version |
| 17 | - **Search** by keyword across policy names, descriptions, and application names |
| 18 | - **Preview** the full YAML content before deploying |
| 19 | - **Detect agents** — discover which of your endpoints have the relevant software installed |
| 20 | - **Deploy** with copy-paste-ready shell commands |
| 21 | |
| 22 | Each policy card shows: |
| 23 | - The CIS benchmark version |
| 24 | - Target platform and application |
| 25 | - Application version |
| 26 | - A description of what the benchmark covers |
| 27 | |
| 28 | --- |
| 29 | |
| 30 | ## Why this is a power feature |
| 31 | |
| 32 | CIS benchmarks are most valuable once your agents are reporting and you have visibility into what software is running across your fleet. SCA Policies builds on top of the SCA Overview by helping you answer two questions: |
| 33 | |
| 34 | 1. **Which policies should I deploy?** — Browse the catalog and filter by the applications you care about. |
| 35 | 2. **Which agents need this policy?** — Use the built-in agent detection to find endpoints running the target software (e.g., Apache, MySQL, NGINX). |
| 36 | |
| 37 | It closes the loop between "we have a benchmark" and "we know where to apply it." |
| 38 | |
| 39 | --- |
| 40 | |
| 41 | ## Where it lives in the UI |
| 42 | |
| 43 | **Menu path:** Agents → Security Configuration Assessment → SCA Policies |
| 44 | |
| 45 | The page shows the full policy catalog with: |
| 46 | - A **search bar** for free-text search across policy names, descriptions, and applications |
| 47 | - A **filter panel** with dropdowns for Platform and Application (dynamically populated from available policies) |
| 48 | - **Policy cards** showing the CIS version, platform badge, application version, policy name, and description |
| 49 | |
| 50 | Clicking a policy card opens the detail view. |
| 51 | |
| 52 | --- |
| 53 | |
| 54 | ## Operator workflows |
| 55 | |
| 56 | ### Browse available policies |
| 57 | |
| 58 | 1. Navigate to **Agents → Security Configuration Assessment → SCA Policies** |
| 59 | 2. The catalog loads automatically from the [CoPilot-SCA](https://github.com/socfortress/CoPilot-SCA) repository |
| 60 | 3. Use the search bar to find policies by name or application (e.g., "apache", "mysql") |
| 61 | 4. Use the filter panel to narrow by platform or application |
| 62 | |
| 63 | ### Detect agents running a specific application |
| 64 | |
| 65 | 1. Click a policy card to open the detail view |
| 66 | 2. In the **Agents with [application]** section, click **Detect Agents** |
| 67 | 3. CoPilot queries the Wazuh Indexer for installed packages matching the application |
| 68 | 4. Results show each agent with the package name, version, and architecture |
| 69 | 5. Use this to identify which endpoints should receive the policy |
| 70 | |
| 71 | ### Preview the policy YAML |
| 72 | |
| 73 | 1. In the policy detail view, find the **Policy YAML** section |
| 74 | 2. Click **Load YAML** to fetch the full policy content from GitHub |
| 75 | 3. Review the checks, requirements, and conditions before deploying |
| 76 | |
| 77 | ### Deploy a policy to an agent |
| 78 | |
| 79 | 1. In the policy detail view, find the **Deployment Instructions** section |
| 80 | 2. The section provides ready-to-run commands tailored to the selected policy |
| 81 | 3. SSH into the target agent and run the commands: |
| 82 | |
| 83 | ```bash |
| 84 | # Download the SCA policy |
| 85 | wget https://raw.githubusercontent.com/socfortress/CoPilot-SCA/main/policies/<app>/<policy_file>.yml \ |
| 86 | -O /var/ossec/ruleset/sca/<policy_file>.yml |
| 87 | |
| 88 | # Set correct ownership |
| 89 | chown root:wazuh /var/ossec/ruleset/sca/<policy_file>.yml |
| 90 | |
| 91 | # Restart the Wazuh agent |
| 92 | systemctl restart wazuh-agent |
| 93 | |
| 94 | # Verify the policy is loaded |
| 95 | tail -f /var/ossec/logs/ossec.log |
| 96 | ``` |
| 97 | |
| 98 | 4. After the agent restarts, Wazuh will automatically pick up the new policy and begin scanning |
| 99 | 5. Results will appear in the [SCA Overview](/user/ui/agents-sca-overview) within a few minutes |
| 100 | |
| 101 | ### End-to-end example: deploying a MySQL benchmark |
| 102 | |
| 103 | 1. Open **SCA Policies** and search for "mysql" |
| 104 | 2. Click the **CIS Oracle MySQL Community Server 5.6 - Debian** card |
| 105 | 3. Click **Detect Agents** — CoPilot finds agent `piHole` (ID 088) with `mariadb-server` installed |
| 106 | 4. Review the **Deployment Instructions** — the commands are pre-filled with the correct filename |
| 107 | 5. SSH into the agent and run: |
| 108 | |
| 109 | ```bash |
| 110 | wget https://raw.githubusercontent.com/socfortress/CoPilot-SCA/main/policies/mysql/cis_mysql_community_deb.yml \ |
| 111 | -O /var/ossec/ruleset/sca/cis_mysql_community_deb.yml |
| 112 | |
| 113 | chown root:wazuh /var/ossec/ruleset/sca/cis_mysql_community_deb.yml |
| 114 | |
| 115 | systemctl restart wazuh-agent |
| 116 | ``` |
| 117 | |
| 118 | 6. Verify in logs: `tail -f /var/ossec/logs/ossec.log` — look for SCA scan messages |
| 119 | 7. Check **SCA Overview** to see the compliance score for the new policy |
| 120 | |
| 121 | --- |
| 122 | |
| 123 | ## Policy detail view |
| 124 | |
| 125 | When you open a policy, you'll see: |
| 126 | |
| 127 | | Section | Description | |
| 128 | |---------|-------------| |
| 129 | | **Policy Information** | ID, application, app version, platform, CIS version | |
| 130 | | **Description** | What the CIS benchmark covers | |
| 131 | | **Deployment Instructions** | Copy-paste shell commands to deploy the `.yml` file to an agent | |
| 132 | | **Agents with [application]** | Detect which agents have the relevant software installed | |
| 133 | | **Applicable SCA Policies** | Other policies in the catalog for the same application | |
| 134 | | **Policy YAML** | Full YAML content preview (loaded on demand) | |
| 135 | |
| 136 | --- |
| 137 | |
| 138 | ## Supported applications |
| 139 | |
| 140 | The following application categories are tracked for automatic agent detection: |
| 141 | |
| 142 | | Application | Package patterns searched | Example policy | |
| 143 | |-------------|--------------------------|----------------| |
| 144 | | **Apache** | `apache2`, `httpd`, `apache2-bin`, `apache2-utils` | CIS Apache HTTP Server 2.4 | |
| 145 | | **NGINX** | `nginx`, `nginx-common`, `nginx-core`, `nginx-full` | CIS NGINX | |
| 146 | | **IIS** | `iis`, `w3svc` | CIS Microsoft IIS | |
| 147 | | **MySQL / MariaDB** | `mysql-server`, `mysql-community-server`, `mariadb-server`, `mariadb-common` | CIS Oracle MySQL Community Server 5.6 | |
| 148 | | **PostgreSQL** | `postgresql`, `postgresql-common`, `postgresql-client` | CIS PostgreSQL | |
| 149 | | **SQL Server** | `mssql-server`, `mssql-tools` | CIS Microsoft SQL Server | |
| 150 | |
| 151 | New applications can be added to the package registry as additional SCA policies are created. |
| 152 | |
| 153 | --- |
| 154 | |
| 155 | ## Setup checklist |
| 156 | |
| 157 | SCA Policies works out of the box with no additional configuration: |
| 158 | |
| 159 | - [x] CoPilot is running (policies are fetched from GitHub automatically) |
| 160 | - [x] Wazuh Indexer is connected (required for agent detection) |
| 161 | - [ ] SSH access to agents (required for deploying `.yml` files) |
| 162 | |
| 163 | --- |
| 164 | |
| 165 | ## Important notes |
| 166 | |
| 167 | - **File location:** SCA policy `.yml` files must be placed in `/var/ossec/ruleset/sca/` on the agent. |
| 168 | - **Ownership:** Files must be owned by `root:wazuh` — use `chown root:wazuh <filename>` after downloading. |
| 169 | - **Agent restart:** The Wazuh agent must be restarted (`systemctl restart wazuh-agent`) to pick up new policies. |
| 170 | - **Verification:** Check `/var/ossec/logs/ossec.log` for SCA scan messages after deploying a new policy. |
| 171 | - **Results:** Once deployed, SCA scan results appear in the [SCA Overview](/user/ui/agents-sca-overview) page. |
| 172 | |
| 173 | --- |
| 174 | |
| 175 | ## Related resources |
| 176 | |
| 177 | - Policy repository: https://github.com/socfortress/CoPilot-SCA |
| 178 | - Wazuh SCA documentation: https://documentation.wazuh.com/current/user-manual/capabilities/sec-config-assessment/index.html |
| 179 | - [SCA Overview (compliance results)](/user/ui/agents-sca-overview) |