Configuration Assessment

​

Overview

​

Key Features

​

Continuous Configuration Monitoring

• Policy-based Scanning: Evaluate systems against security policy benchmarks
• Automated Assessments: Regular scans without manual intervention
• Multi-platform Support: Assess Linux, Windows, and macOS systems
• Custom Policies: Define custom security policies for your environment
• Real-time Alerts: Immediate notification of configuration violations

​

Comprehensive Security Policies

• CIS Benchmarks: Center for Internet Security benchmarks
• NIST Guidelines: NIST security configuration guidelines
• PCI DSS: Payment Card Industry security standards
• HIPAA: Healthcare security configurations
• Custom Policies: Organization-specific security policies

​

Interactive Dashboards

• Overview Dashboard: Organization-wide configuration compliance (Dashboard ID: sca-overview-dashboard)
• Agent Dashboard: Configuration status for specific agents (Dashboard ID: sca-pinned-agent-dashboard)
• Inventory View: Detailed policy check results and compliance status
• Trend Analysis: Track configuration compliance over time

​

Data Sources

​

SCA States

• Pattern: wazuh-states-sca*
• Type: Current configuration assessment states
• Data: Policy check results, compliance status, remediation information

​

Events Data

• Pattern: wazuh-events*
• Type: Configuration change events

​

Assessment Data Structure

​

Policy Structure

​

Policy Components

1. Policy Metadata
   • Policy name and description
   • Target operating system
   • Version information
   • References to standards
2. Security Checks
   • Individual configuration checks
   • Expected vs actual state comparison
   • Pass/fail criteria
3. Remediation Guidance
   • Steps to fix failed checks
   • Commands or procedures
   • Risk assessment
4. Compliance Mapping
   • Linked compliance requirements
   • Regulatory references
   • Control identifiers

​

Check Results

• Passed: Configuration meets the security requirement
• Failed: Configuration does not meet the requirement
• Not Applicable: Check doesn’t apply to this system

​

Inventory View

​

Features

• Policy Compliance Status: Overall compliance for each policy
• Check Details: Individual check results with descriptions
• Remediation Steps: Detailed remediation guidance
• Compliance Mapping: Links to compliance requirements
• Historical Data: Track configuration changes over time

​

Check Details

• Complete check description
• Rationale for the security requirement
• Current configuration state
• Remediation procedures
• Compliance references
• Related checks

​

Use Cases

​

Security Hardening

1. Run configuration assessments on new systems
2. Review failed checks
3. Implement recommended security configurations
4. Re-scan to verify remediation
5. Document baseline security configurations

​

Compliance Auditing

​

PCI DSS Compliance

• Verify security configurations for cardholder data systems
• Track compliance with PCI DSS configuration requirements
• Generate compliance reports for auditors
• Monitor ongoing compliance

​

HIPAA Compliance

• Assess security configurations for systems with ePHI
• Verify technical safeguards implementation
• Document security configurations
• Regular compliance assessments

​

CIS Benchmarks

• Implement CIS security hardening guidelines
• Track compliance with CIS benchmarks
• Prioritize remediation of failed checks
• Maintain security posture

​

Configuration Drift Detection

1. Establish baseline configurations
2. Run regular assessments
3. Detect deviations from baseline
4. Investigate unauthorized changes
5. Restore approved configurations

​

Vulnerability Remediation

1. Identify insecure configurations
2. Assess risk and impact
3. Prioritize remediation efforts
4. Implement secure configurations
5. Verify remediation success

​

Change Management

• Verify changes meet security requirements
• Assess impact of proposed changes
• Document configuration baselines
• Track configuration history
• Rollback problematic changes

​

Integration with Other Modules

• Vulnerability Detection: Link misconfigurations to vulnerabilities
• File Integrity Monitoring: Detect configuration file changes
• System Auditing: Track who made configuration changes
• Threat Hunting: Investigate configuration-related security events
• Compliance Modules: Support PCI DSS, HIPAA, GDPR compliance

​

Common Security Policies

​

CIS Benchmarks

• CIS Red Hat Enterprise Linux Benchmark
• CIS Ubuntu Linux Benchmark
• CIS Windows Server Benchmark
• CIS macOS Benchmark
• CIS Docker Benchmark
• CIS Kubernetes Benchmark

​

Custom Policies

policy:
  id: "custom_policy"
  name: "Organization Security Policy"
  description: "Custom security requirements"
  
  checks:
    - id: "1001"
      title: "Ensure password complexity is enabled"
      condition: all
      rules:
        - 'f:/etc/security/pwquality.conf -> r:^minlen && r:12'

​

Assessment Scheduling

​

Scan Frequency

<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <interval>12h</interval>
  <skip_nfs>yes</skip_nfs>
</sca>

​

Scan Policies

<sca>
  <policies>
    <policy>cis_rhel8.yml</policy>
    <policy>custom_policy.yml</policy>
  </policies>
</sca>

​

Remediation Workflow

​

Standard Remediation Process

1. Identify Failed Checks
   • Review assessment results
   • Filter by severity or compliance requirement
   • Prioritize based on risk
2. Analyze Impact
   • Review check rationale
   • Assess business impact of remediation
   • Identify dependencies
3. Plan Remediation
   • Review remediation steps
   • Plan implementation approach
   • Schedule maintenance window if needed
4. Implement Changes
   • Execute remediation steps
   • Document changes made
   • Test system functionality
5. Verify Remediation
   • Run new assessment
   • Confirm checks now pass
   • Document successful remediation

​

Best Practices

1. Regular Assessments: Schedule frequent scans to detect drift
2. Prioritize Remediation: Focus on high-risk configuration issues first
3. Document Exceptions: Formally document and approve any policy exceptions
4. Test Before Production: Test policy changes in non-production environments
5. Automate Remediation: Use configuration management tools for consistent remediation
6. Track Metrics: Monitor compliance trends and remediation progress
7. Integrate with CM: Link with configuration management systems
8. Educate Teams: Train system administrators on security configurations
9. Review Policies: Regularly review and update security policies
10. Audit Trail: Maintain records of assessments and remediations

​

Reporting

​

Compliance Reports

• Overall compliance percentage
• Policy-by-policy compliance status
• Failed checks by severity
• Remediation progress tracking
• Historical compliance trends

​

Executive Summaries

• High-level compliance posture
• Critical configuration issues
• Remediation status
• Compliance trend analysis

​

Detailed Technical Reports

• Complete check results
• Remediation procedures
• System-by-system analysis
• Compliance requirement mapping

​

Performance Considerations

• Scan Timing: Schedule scans during off-peak hours
• Policy Scope: Focus policies on relevant checks for each system type
• Resource Usage: Monitor system resources during scans
• Network Impact: Consider network bandwidth for policy distribution
• Database Optimization: Maintain SCA indices for optimal performance

​

Component Architecture

// Dashboard component
SCADashboard
  DataSource: SCAStatesDataSource
  Repository: SCAStatesDataSourceRepository
  Dashboard ID: sca-overview-dashboard
  Agent Dashboard ID: sca-pinned-agent-dashboard

// Inventory component
SCAInventory
  DataSource: SCAStatesDataSource
  Repository: SCAStatesDataSourceRepository
  Inventory ID: sca-inventory-dashboard
  Agent Inventory ID: sca-agent-inventory-dashboard
  
// Check details component
SCACheckDetails
  Displays detailed information for individual checks

​

Sample Data

• Category: Security Configuration Assessment
• Pattern: wazuh-states-sca*

​

Common Configuration Issues

​

Critical Issues

• Default passwords still in use
• Unnecessary services enabled
• Insecure protocol configurations
• Missing security patches
• Weak encryption settings

​

High Priority Issues

• Insufficient password complexity
• Disabled security features
• Insecure file permissions
• Unnecessary open ports
• Missing audit logging

​

Medium Priority Issues

• Suboptimal configurations
• Missing hardening measures
• Incomplete security settings
• Legacy protocol support

​

Related Resources

• Vulnerability Detection
• File Integrity Monitoring
• System Auditing
• Compliance Standards
• CIS Benchmarks