| 1 | --- |
| 2 | title: SCA reports (Wazuh) |
| 3 | description: Generate CSV reports for Security Configuration Assessment (SCA) results from Wazuh policy scans. |
| 4 | --- |
| 5 | |
| 6 | # SCA reports (Wazuh) |
| 7 | |
| 8 | **Menu:** Report Creation → SCA Reports |
| 9 | |
| 10 | SCA (Security Configuration Assessment) reports pull from the **Wazuh SCA module**, which evaluates endpoints against hardening/compliance policies. |
| 11 | |
| 12 | Wazuh SCA model (simplified): |
| 13 | - agents scan against SCA **policies** (rules/checks) |
| 14 | - results are tracked per check (pass/fail/not applicable) |
| 15 | - agents send diffs/summary to the manager to reduce noise |
| 16 | |
| 17 |  |
| 18 | |
| 19 | --- |
| 20 | |
| 21 | ## What you can do |
| 22 | |
| 23 | - Review SCA posture across a customer (policy score, failing checks) |
| 24 | - Generate a CSV report for auditing and remediation planning |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## Step 1 — Review SCA overview |
| 29 | |
| 30 |  |
| 31 | |
| 32 | Common operator filters: |
| 33 | - Customer |
| 34 | - Agent/host |
| 35 | - Policy id/name |
| 36 | - Minimum/maximum score |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | ## Step 2 — Generate and download |
| 41 | |
| 42 |  |
| 43 | |
| 44 | When you generate an SCA report, CoPilot produces a **CSV** containing policy results. |
| 45 | |
| 46 | Operator tips: |
| 47 | - Treat SCA as a “secure baseline drift” signal. |
| 48 | - Use policy-based grouping (CIS/NIST mappings) for audit discussions. |
| 49 | |
| 50 | --- |
| 51 | |
| 52 | ## Common gotchas |
| 53 | |
| 54 | ### “No SCA data found” |
| 55 | Common causes: |
| 56 | - SCA is not enabled on the agents |
| 57 | - policies are not deployed |
| 58 | - the agents haven’t scanned yet (or haven’t checked in) |
| 59 | |
| 60 | ### “Why did results change?” |
| 61 | SCA alerts are typically emitted on **status change** between scans (pass↔fail↔n/a) rather than spamming every scan. |