wazuhscatune

wazuhscatune is a local application for tailoring a trusted Wazuh Security Configuration Assessment (SCA) baseline. It opens a browser-based review UI where every check is explicitly accepted, recorded as an exception, or marked as not applicable.

Review states:

• Unreviewed — not yet explicitly reviewed.
• Accepted — retained in the tailored policy.
• Exception — removed with a justification because the check applies but the deviation is intentionally accepted, for example because risk is accepted or an alternative control is used.
• Not Applicable — removed with a justification because the check does not apply to the target system or role.

Requirements

Python 3.11 or newer. Python 3.11, 3.12, and 3.13 are tested on Windows, macOS, and Linux.

wazuhscatune is a local single-user application. Server deployment, multi-user operation, and use of the internal sca package as a Python library are not supported.

Install

Install with pipx:

pipx install wazuhscatune

From a local checkout:

pipx install .

Run

wazuhscatune

The application listens on http://127.0.0.1:5000 and opens the local browser. If the browser does not open automatically, open that address manually.

Workflow

1. Upload a Wazuh SCA .yml, .yaml, or a ZIP previously exported by wazuhscatune.
2. Name and describe the tailored policy.
3. Review every check as accepted, as a justified exception, or as justified Not Applicable.
4. Review the final decisions.
5. Export a ZIP containing:
   • <policy>.yml — tailored SCA policy;
   • <policy>_exceptions.yml — machine-readable removal record, split between accepted-risk exceptions and not-applicable checks;
   • <policy>_exceptions.md — human-readable report with the same categories and baseline compliance mappings.

Exception and Not Applicable decisions both remove the check from the tailored policy. Export is blocked until every check has been reviewed, and at least one check must remain included. The uploaded baseline is never modified.

Local data

Review state is saved locally after each decision. Drafts can be recovered while their uploaded baseline remains available. Application-created temporary files expire after 48 hours by default; configure this with WAZUHSCATUNE_FILE_TTL_HOURS.

The browser session lifetime is 24 hours. Uploads, drafts, session files, exports, and logs remain on the local machine.

Validation

Input validation covers YAML syntax and expected Wazuh SCA structure, including policy metadata, requirements, checks, rule lists, compliance mappings, variables, and unique integer check IDs. ZIP imports are bounded by upload, member-count, and extracted policy-size limits. The application does not execute SCA checks or emulate the Wazuh SCA engine.

Development

For development and testing:

python -m pip install -e '.[dev]'
python -m pytest
python -m pycodestyle sca
python -m mypy sca
python -m compileall -q sca
python -m build
python -m twine check --strict dist/*

Python 3.11 is the compatibility floor. pyproject.toml is the authoritative package and dependency declaration.

Release history is kept in CHANGELOG.md.

License

GNU General Public License v3 or later. See LICENSE.