Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adapt SCA rulesets to 3.10 syntax #406

Merged
merged 263 commits into from
Aug 20, 2019
Merged

Conversation

JuantAldea
Copy link
Contributor

@JuantAldea JuantAldea commented May 22, 2019

Addresses issue #404

This PR adapts the rulesets for the SCA syntax introduced in Wazuh 3.10, corrects several mistakes.

Changes include:

  • Rule logic inversion. Rules are written so that "true" is the expected, success, value.
  • Removal of semicolon as rule end mark.
  • Usage of the 3.10 whole rule negation operator not, which negates the rule result. Removes previous IN/NIN notation.
  • Usage of the 3.10 new rule type for numerical comparison n:.
  • Compliance field format changed to allow lists.
  • Proper formating of YML files.
  • Fixing several mistakes in the rules themselves.
  • Debian & Windows policy splitting.
  • Removal of generic ssh, pw and audit_rcl policies.
  • Policies renamed to remove "_rcl".
  • Addition of HIPAA y NIST 800 53 compliance mapping.

@JuantAldea JuantAldea changed the base branch from master to 3.10 May 22, 2019 16:40
@JuantAldea
Copy link
Contributor Author

JuantAldea commented May 24, 2019

Adapted

  • Generics
  • Debian
  • Red Hat 7

Comments

  • Several rules fixed on the fly.

@chemamartinez chemamartinez marked this pull request as ready for review August 12, 2019 08:59
@chemamartinez chemamartinez merged commit eded967 into 3.10 Aug 20, 2019
@chemamartinez chemamartinez deleted the 404-adapt-sca-rules-to-new-syntax branch August 20, 2019 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants