SCA Tooling

Lets you run Wazuh Security Configuration Assessment (SCA) policies (CIS YAML) locally, using the same wazuh-regex engine Wazuh uses in production. Useful for quick local validation, fast client checks, and iterating on policy files while you write them.

./sca.sh -pdc                       # run the full policy, per-check output
./sca.sh -soc -pdc -i 18500         # run a single check by ID
./sca.sh -f ./cis_ubuntu22-04.yml   # run a different policy file
./sca.sh -h                         # show help

• bash 4.0+
• yq + jq - use the apt packages: sudo apt update && sudo apt install -y yq jq. The script also handles the snap/mikefarah yq, but apt is recommended (snap install yq emits YAML by default unless given -o=json).
• wazuh-regex + its shared libraries - installed by ./install-wazuh-regex.sh in the next step.

# 1. Install wazuh-regex + shared libraries (no root required)
./install-wazuh-regex.sh
#    optionally pin a specific wazuh-manager version:
WAZUH_MANAGER_VERSION=4.9.1-1 ./install-wazuh-regex.sh

# 2. (Optional) refresh the bundled policies from upstream Wazuh.
#    The repo already ships cis_ubuntu26-04.yml, cis_ubuntu24-04.yml and cis_ubuntu22-04.yml.
curl -sSfLo ./cis_ubuntu26-04.yml \
  https://raw.githubusercontent.com/wazuh/wazuh/refs/heads/main/ruleset/sca/ubuntu/cis_ubuntu26-04.yml

LD_LIBRARY_PATH defaults to ./wazuh-lib. If you keep a manual copy elsewhere, point the script at it with -wl <PATH>.

Exit code: 0 = no compliance failures, 1 = at least one check failed, 2 = script/config error. A red CI run therefore means the policy found issues - not that the script crashed.

Coverage is tracked against the CIS Ubuntu 24.04 LTS benchmark. Per section, the format is (total benchmark rules) (checks implemented in the policy) (-missing).

Results are measured on the author's host via ./sca.sh -soc -pdc -psc (-soc skips OS-version validation); your numbers will differ based on your configuration and hardening state.

• SCA workflow (.github/workflows/sca.yml): on push/PR to main it installs wazuh-regex via ./install-wazuh-regex.sh, then runs the script against each bundled policy through a strategy.matrix (fail-fast: false). Reports are uploaded as artifacts even on failure (if: always()).
• Renovate (.github/renovate.json): keeps GitHub Actions and pre-commit hooks up to date; grouped and auto-merged. Requires installing the Renovate GitHub App for the repository.

pre-commit install        # install hooks (codespell, yamllint, shellcheck, prettier, gitleaks, ...)
pre-commit run --all-files
shellcheck sca.sh         # lint the script

1. Fork and create a feature branch.
2. Make your changes.
3. Run pre-commit and shellcheck.
4. Open a pull request with the pull_request_detailed.md template.

• Wazuh SCA documentation
• Wazuh Regex tool documentation
• Wazuh SCA policy repository
• CIS Benchmarks
• Ansible CIS Ubuntu 24.04
• Ansible CIS Ubuntu 22.04
• Wazuh SCA Rulesets
  • CIS Ubuntu 26.04
  • CIS Ubuntu 24.04
• Wazuh Issues
  • Create a test tool for SCA rules
  • Create SCA policy for Ubuntu 24.04 LTS
• Other
  • https://gist.github.com/MVladislav/b186d7dc6f151301cdd7b3943993d47c

MIT - see LICENSE.