SCA Regex: Ensure events that modify the system's network environment are collected

[nmartinez-nimeops]

Hi,
seems that the regex is not good for Ensure events that modify the system's network environment are collected for debian

- 'f:/etc/audit/audit.rules -> r:^-w && r:/etc/sysconfig/network && r:-p wa && r:-k system-locale'

should be:

- 'f:/etc/audit/audit.rules -> r:^-w && r:/etc/networks && r:-p wa && r:-k system-locale'
- 'f:/etc/audit/audit.rules -> r:^-w && r:/etc/network && r:-p wa && r:-k system-locale'

File: https://github.com/wazuh/wazuh/blob/master/etc/sca/debian/cis_debian9_L2.yml

[cristgl]

Hello @nimeops and thanks again for reporting these bugs.

I fixed it in this PR wazuh/wazuh-ruleset#527. However, I've seen that you have added another line with the file /etc/networks. Can you explain this? It is not reflected in the CIS Debian benchmark.

Kind regards,
Cristina

[nmartinez-nimeops]

Hi,
on Debian/Ubuntu, there are ressources to check:

• file /etc/networks
• directory /etc/network