# wazuh-sca-cis-benchmark

Companion files for the lesson **Wazuh SCA: CIS Benchmarks and Custom Policies**.

Lesson: https://maheshtata.com/wazuh/wazuh-sca-cis-benchmark/

Tested against: Wazuh 5.0 (beta5 documentation, September 2026). `verified: false` until the lab pass.

## Files

| File | Purpose |
| --- | --- |
| `sca_ssh_baseline.yml` | A small custom SCA policy with four checks covering an SSH hardening baseline. Demonstrates the `policy`, `requirements`, `variables` and `checks` sections, the `f:`, `c:` and `n:` rule types, and the `all` and `none` conditions. |
| `agent.conf` | Shared group configuration fragment that enables the custom policy on Linux agents. Goes in `/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf`. |

## Using them

1. Copy `sca_ssh_baseline.yml` into the group directory on the manager, for example
   `/var/wazuh-manager/etc/shared/linux-servers/`, and set ownership to `wazuh-manager:wazuh-manager`.
2. Merge the `<sca>` block from `agent.conf` into that group's `agent.conf`.
3. Validate with `/var/wazuh-manager/bin/verify-agent-conf` before making the file active.
4. Confirm the policy appears under **Endpoint security > Configuration assessment > Inventory**
   for an agent in the group.

## Caveats

- Check IDs must be unique across every policy loaded on an agent. These start at `90000` to
  stay clear of the bundled CIS policies.
- The bundled policies under the agent `ruleset/sca` directory are replaced on upgrade. Keep
  custom policies somewhere else, which is what the group directory achieves.
- Command rules (`c:`) in a policy pushed from the manager only run when
  `sca.remote_commands=1` is set in the agent's `local_internal_options.conf`. Read the lesson
  section on that setting before enabling it.

## Sources

- https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/sec-config-assessment/how-to-configure.html
- https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/sec-config-assessment/how-it-works.html
- https://documentation.wazuh.com/5.0-beta/user-manual/reference/centralized-configuration.html