How to configure SCA

Enabling and disabling policies

By default, the Wazuh Agent will run scans for every policy (.yaml or .yml files) present in their ruleset folder:

• Linux agents: <agent-installation-folder>/ruleset/sca.

• Windows agents: <agent-installation-folder>\ruleset\sca.

To enable a policy file that's outside the default folder, add a line like

<policy>/some/custom/policy/folder/policy_file_to_enable.yml</policy>

to the policies section of the SCA module.

There are two ways to disable policies, the simplest one is by renaming the policy file by adding .disabled (or anything different from .yaml or .yml) after their YAML extension. The second is to disable them from the ossec.conf by adding a line such as

<policy enabled="no">/var/ossec/etc/shared/policy_file_to_disable.yml</policy>

to the policies section of the SCA module.

How to share policy files and configuration with agents

As described in the centralized configuration section, the Wazuh manager has the ability to push files and configurations to connected agents.

This feature can be used to push policy files to agents in defined groups. By default, every agent belongs to the default group, so we can use this group as example.

In order to push a new policy from the manager it should be placed in the directory /var/ossec/etc/shared/default, and be owned by user ossec.

In addition, to push configuration, the same strategy applies. For instance, in order to add a policy, add a block like the following to the /var/ossec/etc/shared/default/agent.conf as per the example.

<agent_config>
    <!-- Shared agent configuration here -->
    <sca>
        <policies>
            <policy>/var/ossec/etc/shared/your_policy_file.yml</policy>
        </policies>
    </sca>
</agent_config>

This <sca> block will be merged with the <sca> block on the agent side and the new configuration will be added.