> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration Assessment

> Scan your assets as part of a configuration assessment audit to ensure compliance with security policies and best practices

## Overview

The Configuration Assessment module (also known as Security Configuration Assessment or SCA) continuously evaluates the security configuration of your systems against established baselines and best practices. It helps identify misconfigurations and compliance issues by scanning assets and comparing their configurations to predefined security policies.

## Key Features

### Continuous Configuration Monitoring

Automated, continuous assessment of system configurations:

* **Policy-based Scanning**: Evaluate systems against security policy benchmarks
* **Automated Assessments**: Regular scans without manual intervention
* **Multi-platform Support**: Assess Linux, Windows, and macOS systems
* **Custom Policies**: Define custom security policies for your environment
* **Real-time Alerts**: Immediate notification of configuration violations

### Comprehensive Security Policies

Pre-built policies for industry standards and best practices:

* **CIS Benchmarks**: Center for Internet Security benchmarks
* **NIST Guidelines**: NIST security configuration guidelines
* **PCI DSS**: Payment Card Industry security standards
* **HIPAA**: Healthcare security configurations
* **Custom Policies**: Organization-specific security policies

### Interactive Dashboards

Powerful visualization and analysis tools:

* **Overview Dashboard**: Organization-wide configuration compliance (Dashboard ID: `sca-overview-dashboard`)
* **Agent Dashboard**: Configuration status for specific agents (Dashboard ID: `sca-pinned-agent-dashboard`)
* **Inventory View**: Detailed policy check results and compliance status
* **Trend Analysis**: Track configuration compliance over time

## Data Sources

Configuration Assessment utilizes specialized index patterns:

### SCA States

* **Pattern**: `wazuh-states-sca*`
* **Type**: Current configuration assessment states
* **Data**: Policy check results, compliance status, remediation information

### Events Data

* **Pattern**: `wazuh-events*`
* **Type**: Configuration change events

## Assessment Data Structure

Configuration assessment data includes:

| Field | Description |
| - | - |
| `timestamp` | When the assessment was performed |
| `wazuh.agent.name` | Name of the assessed agent |
| `sca.policy` | Name of the security policy evaluated |
| `sca.check.id` | Unique identifier for the check |
| `sca.check.title` | Title of the security check |
| `sca.check.description` | Detailed check description |
| `sca.check.result` | Result (passed, failed, not applicable) |
| `sca.check.remediation` | Remediation steps |
| `sca.check.compliance` | Associated compliance requirements |
| `sca.check.rationale` | Why this check is important |

## Policy Structure

### Policy Components

Each security policy consists of:

1. **Policy Metadata**
   * Policy name and description
   * Target operating system
   * Version information
   * References to standards

2. **Security Checks**
   * Individual configuration checks
   * Expected vs actual state comparison
   * Pass/fail criteria

3. **Remediation Guidance**
   * Steps to fix failed checks
   * Commands or procedures
   * Risk assessment

4. **Compliance Mapping**
   * Linked compliance requirements
   * Regulatory references
   * Control identifiers

### Check Results

* **Passed**: Configuration meets the security requirement
* **Failed**: Configuration does not meet the requirement
* **Not Applicable**: Check doesn't apply to this system

## Inventory View

The SCA inventory provides comprehensive configuration assessment details:

### Features

* **Policy Compliance Status**: Overall compliance for each policy
* **Check Details**: Individual check results with descriptions
* **Remediation Steps**: Detailed remediation guidance
* **Compliance Mapping**: Links to compliance requirements
* **Historical Data**: Track configuration changes over time

**Component**: `SCAInventory`\
**Dashboard ID**: `sca-inventory-dashboard`\
**Agent Dashboard ID**: `sca-agent-inventory-dashboard`\
**Location**: `/plugins/main/public/components/overview/sca/components/inventory/`

### Check Details

The `SCACheckDetails` component provides in-depth information:

* Complete check description
* Rationale for the security requirement
* Current configuration state
* Remediation procedures
* Compliance references
* Related checks

## Use Cases

### Security Hardening

Harden systems according to best practices:

1. Run configuration assessments on new systems
2. Review failed checks
3. Implement recommended security configurations
4. Re-scan to verify remediation
5. Document baseline security configurations

### Compliance Auditing

Demonstrate compliance with regulatory requirements:

#### PCI DSS Compliance

* Verify security configurations for cardholder data systems
* Track compliance with PCI DSS configuration requirements
* Generate compliance reports for auditors
* Monitor ongoing compliance

#### HIPAA Compliance

* Assess security configurations for systems with ePHI
* Verify technical safeguards implementation
* Document security configurations
* Regular compliance assessments

#### CIS Benchmarks

* Implement CIS security hardening guidelines
* Track compliance with CIS benchmarks
* Prioritize remediation of failed checks
* Maintain security posture

### Configuration Drift Detection

Identify unauthorized configuration changes:

1. Establish baseline configurations
2. Run regular assessments
3. Detect deviations from baseline
4. Investigate unauthorized changes
5. Restore approved configurations

### Vulnerability Remediation

Address configuration-based vulnerabilities:

1. Identify insecure configurations
2. Assess risk and impact
3. Prioritize remediation efforts
4. Implement secure configurations
5. Verify remediation success

### Change Management

Support IT change management processes:

* Verify changes meet security requirements
* Assess impact of proposed changes
* Document configuration baselines
* Track configuration history
* Rollback problematic changes

## Integration with Other Modules

Configuration Assessment integrates with:

* **Vulnerability Detection**: Link misconfigurations to vulnerabilities
* **File Integrity Monitoring**: Detect configuration file changes
* **System Auditing**: Track who made configuration changes
* **Threat Hunting**: Investigate configuration-related security events
* **Compliance Modules**: Support PCI DSS, HIPAA, GDPR compliance

## Common Security Policies

### CIS Benchmarks

Comprehensive security configuration guidelines:

* CIS Red Hat Enterprise Linux Benchmark
* CIS Ubuntu Linux Benchmark
* CIS Windows Server Benchmark
* CIS macOS Benchmark
* CIS Docker Benchmark
* CIS Kubernetes Benchmark

### Custom Policies

Create organization-specific policies:

```yaml theme={null}
policy:
  id: "custom_policy"
  name: "Organization Security Policy"
  description: "Custom security requirements"
  
  checks:
    - id: "1001"
      title: "Ensure password complexity is enabled"
      condition: all
      rules:
        - 'f:/etc/security/pwquality.conf -> r:^minlen && r:12'
```

## Assessment Scheduling

### Scan Frequency

Configure how often assessments run:

```xml theme={null}
<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <interval>12h</interval>
  <skip_nfs>yes</skip_nfs>
</sca>
```

### Scan Policies

Select which policies to apply:

```xml theme={null}
<sca>
  <policies>
    <policy>cis_rhel8.yml</policy>
    <policy>custom_policy.yml</policy>
  </policies>
</sca>
```

## Remediation Workflow

### Standard Remediation Process

1. **Identify Failed Checks**
   * Review assessment results
   * Filter by severity or compliance requirement
   * Prioritize based on risk

2. **Analyze Impact**
   * Review check rationale
   * Assess business impact of remediation
   * Identify dependencies

3. **Plan Remediation**
   * Review remediation steps
   * Plan implementation approach
   * Schedule maintenance window if needed

4. **Implement Changes**
   * Execute remediation steps
   * Document changes made
   * Test system functionality

5. **Verify Remediation**
   * Run new assessment
   * Confirm checks now pass
   * Document successful remediation

## Best Practices

1. **Regular Assessments**: Schedule frequent scans to detect drift
2. **Prioritize Remediation**: Focus on high-risk configuration issues first
3. **Document Exceptions**: Formally document and approve any policy exceptions
4. **Test Before Production**: Test policy changes in non-production environments
5. **Automate Remediation**: Use configuration management tools for consistent remediation
6. **Track Metrics**: Monitor compliance trends and remediation progress
7. **Integrate with CM**: Link with configuration management systems
8. **Educate Teams**: Train system administrators on security configurations
9. **Review Policies**: Regularly review and update security policies
10. **Audit Trail**: Maintain records of assessments and remediations

## Reporting

Generate comprehensive configuration assessment reports:

### Compliance Reports

* Overall compliance percentage
* Policy-by-policy compliance status
* Failed checks by severity
* Remediation progress tracking
* Historical compliance trends

### Executive Summaries

* High-level compliance posture
* Critical configuration issues
* Remediation status
* Compliance trend analysis

### Detailed Technical Reports

* Complete check results
* Remediation procedures
* System-by-system analysis
* Compliance requirement mapping

## Performance Considerations

* **Scan Timing**: Schedule scans during off-peak hours
* **Policy Scope**: Focus policies on relevant checks for each system type
* **Resource Usage**: Monitor system resources during scans
* **Network Impact**: Consider network bandwidth for policy distribution
* **Database Optimization**: Maintain SCA indices for optimal performance

## Component Architecture

The Configuration Assessment module architecture:

```typescript theme={null}
// Dashboard component
SCADashboard
  DataSource: SCAStatesDataSource
  Repository: SCAStatesDataSourceRepository
  Dashboard ID: sca-overview-dashboard
  Agent Dashboard ID: sca-pinned-agent-dashboard

// Inventory component
SCAInventory
  DataSource: SCAStatesDataSource
  Repository: SCAStatesDataSourceRepository
  Inventory ID: sca-inventory-dashboard
  Agent Inventory ID: sca-agent-inventory-dashboard
  
// Check details component
SCACheckDetails
  Displays detailed information for individual checks
```

Location in codebase: `/plugins/main/public/components/overview/sca/`

## Sample Data

The module supports sample data for testing:

* **Category**: Security Configuration Assessment
* **Pattern**: `wazuh-states-sca*`

## Common Configuration Issues

### Critical Issues

* Default passwords still in use
* Unnecessary services enabled
* Insecure protocol configurations
* Missing security patches
* Weak encryption settings

### High Priority Issues

* Insufficient password complexity
* Disabled security features
* Insecure file permissions
* Unnecessary open ports
* Missing audit logging

### Medium Priority Issues

* Suboptimal configurations
* Missing hardening measures
* Incomplete security settings
* Legacy protocol support

## Related Resources

* [Vulnerability Detection](/modules/vulnerability-detection)
* [File Integrity Monitoring](/modules/file-integrity-monitoring)
* [System Auditing](/modules/system-auditing)
* [Compliance Standards](/compliance/overview)
* [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.