The Security Configuration Assessment (SCA) module runs CIS Benchmark and custom hardening policies against every Wazuh agent. Policies are YAML files shipped by Wazuh for major Linux distros, Windows and macOS, no extra agents needed.
1. Enable SCA in agent.conf
<sca>
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<policies>
<policy>cis_debian10.yml</policy>
</policies>
</sca>2. Restart the agent
systemctl restart wazuh-agent3. View results
In the dashboard open Security configuration assessment -> select the agent -> see pass/fail per CIS control with remediation guidance.
Note: You can write custom policies in YAML (rules: f:/etc/ssh/sshd_config -> r:^PermitRootLogin no) to enforce your own hardening standards.
We build custom SCA packs for ISO 27001, NIST 800-171 and SOC 2, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhSCACISCompliance