Upon installation, agents will include the appropriate policies for their particular Operating System. For the full list of Officially supported policy files see table Available SCA policies. These policies are included with the Wazuh Manager installation so that they can be easily enabled.
For a detailed description of the various configuration parameters of SCA, please check the SCA reference.
By default, the Wazuh Agent will run scans for every policy (.yaml or .yml files) present in their ruleset folder:
The contents of the aforementioned default ruleset folders are neither kept across installations nor updates. If you wish to modify or add new policies, place them under an alternative folder.
To enable a policy file that's outside the Wazuh installation folder, add a line like
You can also specify a relative path to the Wazuh installation directory.
There are two ways to disable policies. The simplest one is renaming the policy file by adding
(or anything different from .yaml or .yml) after their YAML extension. The second is to disable them from
the ossec.conf by adding a line such as the following:
to the policies section of the SCA module.