Metadata-Version: 2.4
Name: wazuhscatune
Version: 0.1.0
Summary: Tailor Wazuh SCA baselines with documented exceptions
Author-email: Zafer Balkan <zafer@zaferbalkan.com>
Maintainer-email: Zafer Balkan <zafer@zaferbalkan.com>
License-Expression: GPL-3.0-or-later
Project-URL: Homepage, https://github.com/zbalkan/wazuhscatune
Project-URL: Repository, https://github.com/zbalkan/wazuhscatune
Project-URL: Issues, https://github.com/zbalkan/wazuhscatune/issues
Project-URL: Documentation, https://github.com/zbalkan/wazuhscatune#readme
Keywords: wazuh,sca,security-configuration-assessment,compliance,hardening
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Web Environment
Classifier: Framework :: Flask
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: Flask==3.1.3
Requires-Dist: Flask-Session==0.5.0
Requires-Dist: ruamel.yaml==0.18.6
Requires-Dist: Werkzeug==3.1.8
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: mypy>=1.9; extra == "dev"
Requires-Dist: pip-audit>=2.7; extra == "dev"
Requires-Dist: pycodestyle>=2.11; extra == "dev"
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: pytest-cov>=5; extra == "dev"
Requires-Dist: twine>=5; extra == "dev"
Dynamic: license-file

# wazuhscatune

`wazuhscatune` is a local application for tailoring a trusted Wazuh Security
Configuration Assessment (SCA) baseline. It opens a browser-based review UI where
each check is either accepted or recorded as an exception with a justification.

Review states:

- **Unreviewed** — not yet explicitly reviewed.
- **Accepted** — retained in the tailored policy.
- **Exception** — justified and removed from the tailored policy.

![Review Wazuh SCA checks](assets/review.png "Review Wazuh SCA checks")

## Requirements

Python 3.11 or newer. Python 3.11, 3.12, and 3.13 are tested on Windows, macOS,
and Linux.

`wazuhscatune` is a local single-user application. Server deployment, multi-user
operation, and use of the internal `sca` package as a Python library are not
supported.

## Install

Install with `pipx`:

```bash
pipx install wazuhscatune
```

From a local checkout:

```bash
pipx install .
```

## Run

```bash
wazuhscatune
```

The application listens on `http://127.0.0.1:5000` and opens the local browser.
If the browser does not open automatically, open that address manually.

![Upload Wazuh SCA file](assets/upload.png "Upload Wazuh SCA file")

## Workflow

1. Upload a Wazuh SCA `.yml`, `.yaml`, or a ZIP previously exported by
   `wazuhscatune`.
2. Name and describe the tailored policy.
3. Review every check as accepted or as a justified exception.
4. Review the final decisions.
5. Export a ZIP containing:
   - `<policy>.yml` — tailored SCA policy;
   - `<policy>_exceptions.yml` — machine-readable exception record;
   - `<policy>_exceptions.md` — human-readable exception record.

Export is blocked until every check has been reviewed. The uploaded baseline is
never modified.

![Review decisions before export](assets/approval.png "Review decisions before export")

## Local data

Review state is saved locally after each decision. Drafts can be recovered while
their uploaded baseline remains available. Application-created temporary files
expire after 48 hours by default; configure this with
`WAZUHSCATUNE_FILE_TTL_HOURS`.

The browser session lifetime is 24 hours. Uploads, drafts, session files, exports,
and logs remain on the local machine.

## Validation

Input validation covers YAML syntax and expected Wazuh SCA structure, including
policy metadata, requirements, checks, rule lists, compliance mappings, and unique
integer check IDs. ZIP imports are bounded by upload, member-count, and extracted
policy-size limits. The application does not execute SCA checks or emulate the
Wazuh SCA engine.

## Development

For development and testing:

```bash
python -m pip install -e '.[dev]'
python -m pytest
python -m pycodestyle sca
python -m mypy sca
python -m compileall -q sca
python -m build
python -m twine check --strict dist/*
```

Python 3.11 is the compatibility floor. `pyproject.toml` is the authoritative
package and dependency declaration.

Release history is kept in [`CHANGELOG.md`](CHANGELOG.md).

## License

GNU General Public License v3 or later. See `LICENSE`.
