How to configure SCA

Enabling and disabling policies

By default, the Wazuh Agent will run scans for every policy (.yaml or .yml files) present in their ruleset folder:

• Linux agents: <agent-installation-folder>/ruleset/sca.

• Windows agents: <agent-installation-folder>\ruleset\sca.

To enable a policy file that's outside the default folder, add a line like

<policy>/some/custom/policy/folder/policy_file_to_enable.yml</policy>

to the policies section of the SCA module.

There are two ways to disable policies, the simplest one is by renaming the policy file by adding .disabled (or anything different from .yaml or .yml) after their YAML extension. The second is to disable them from the ossec.conf by adding a line such as

<policy enabled="no">/var/ossec/etc/shared/policy_file_to_disable.yml</policy>

to the policies section of the SCA module.

How to share policy files and configuration with the Wazuh agents

As described in the centralized configuration section, the Wazuh manager has the ability to push files and configurations to connected Wazuh agents.

This feature can be used to push policy files to the Wazuh agents in defined groups. By default, every Wazuh agent belongs to the default group, which is used here as an example:

1. Edit the Wazuh agent’s local_internal_options.conf file to allow the execution of commands in SCA policies sent from the Wazuh manager:

   # echo "sca.remote_commands=1" >> /var/ossec/etc/local_internal_options.conf
   

2. Place a new policy file in the Wazuh manager's /var/ossec/etc/shared/default folder. This file must be owned by the user ossec.

3. Add the configuration block to the Wazuh manager's /var/ossec/etc/shared/default/agent.conf file to push the new policy file to the Wazuh agent:

   <agent_config>
       <!-- Shared agent configuration here -->
       <sca>
           <policies>
               <policy>/var/ossec/etc/shared/your_policy_file.yml</policy>
           </policies>
       </sca>
   </agent_config>
   

The <sca> block will be merged with the <sca> block on the Wazuh agent side and the new configuration will be added.