Metadata-Version: 2.4
Name: wazuhscatune
Version: 0.2.0
Summary: Tailor Wazuh SCA baselines with documented review decisions
Author-email: Zafer Balkan <zafer@zaferbalkan.com>
Maintainer-email: Zafer Balkan <zafer@zaferbalkan.com>
License-Expression: GPL-3.0-or-later
Project-URL: Homepage, https://github.com/zbalkan/wazuhscatune
Project-URL: Repository, https://github.com/zbalkan/wazuhscatune
Project-URL: Issues, https://github.com/zbalkan/wazuhscatune/issues
Project-URL: Documentation, https://github.com/zbalkan/wazuhscatune#readme
Keywords: wazuh,sca,security-configuration-assessment,compliance,hardening
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Web Environment
Classifier: Framework :: Flask
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: Flask==3.1.3
Requires-Dist: Flask-Session==0.5.0
Requires-Dist: ruamel.yaml==0.18.6
Requires-Dist: Werkzeug==3.1.8
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: mypy>=1.9; extra == "dev"
Requires-Dist: pip-audit>=2.7; extra == "dev"
Requires-Dist: pycodestyle>=2.11; extra == "dev"
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: pytest-cov>=5; extra == "dev"
Requires-Dist: twine>=5; extra == "dev"
Dynamic: license-file

# wazuhscatune

`wazuhscatune` is a local application for tailoring a trusted Wazuh Security Configuration Assessment (SCA) baseline. It opens a browser-based review UI where every check is explicitly accepted, recorded as an exception, or marked as not applicable.

Review states:

- **Unreviewed** — not yet explicitly reviewed.
- **Accepted** — retained in the tailored policy.
- **Exception** — removed with a justification because the check applies but the deviation is intentionally accepted, for example because risk is accepted or an alternative control is used.
- **Not Applicable** — removed with a justification because the check does not apply to the target system or role.

![Review Wazuh SCA checks](https://github.com/zbalkan/wazuhscatune/blob/main/assets/review.png "Review Wazuh SCA checks")

## Requirements

Python 3.11 or newer. Python 3.11, 3.12, and 3.13 are tested on Windows, macOS, and Linux.

`wazuhscatune` is a local single-user application. Server deployment, multi-user operation, and use of the internal `sca` package as a Python library are not supported.

## Install

Install with `pipx`:

```bash
pipx install wazuhscatune
```

From a local checkout:

```bash
pipx install .
```

## Run

```bash
wazuhscatune
```

The application listens on `http://127.0.0.1:5000` and opens the local browser. If the browser does not open automatically, open that address manually.

![Upload Wazuh SCA file](https://github.com/zbalkan/wazuhscatune/blob/main/assets/upload.png "Upload Wazuh SCA file")

## Workflow

1. Upload a Wazuh SCA `.yml`, `.yaml`, or a ZIP previously exported by `wazuhscatune`.
2. Name and describe the tailored policy.
3. Review every check as accepted, as a justified exception, or as justified Not Applicable.
4. Review the final decisions.
5. Export a ZIP containing:
   - `<policy>.yml` — tailored SCA policy;
   - `<policy>_exceptions.yml` — machine-readable removal record, split between accepted-risk exceptions and not-applicable checks;
   - `<policy>_exceptions.md` — human-readable report with the same categories and baseline compliance mappings.

Exception and Not Applicable decisions both remove the check from the tailored policy. Export is blocked until every check has been reviewed, and at least one check must remain included. The uploaded baseline is never modified.

![Review decisions before export](https://github.com/zbalkan/wazuhscatune/raw/main/assets/approval.png "Review decisions before export")

## Local data

Review state is saved locally after each decision. Drafts can be recovered while their uploaded baseline remains available. Application-created temporary files expire after 48 hours by default; configure this with `WAZUHSCATUNE_FILE_TTL_HOURS`.

The browser session lifetime is 24 hours. Uploads, drafts, session files, exports, and logs remain on the local machine.

## Validation

Input validation covers YAML syntax and expected Wazuh SCA structure, including policy metadata, requirements, checks, rule lists, compliance mappings, variables, and unique integer check IDs. ZIP imports are bounded by upload, member-count, and extracted policy-size limits. The application does not execute SCA checks or emulate the Wazuh SCA engine.

## Development

For development and testing:

```bash
python -m pip install -e '.[dev]'
python -m pytest
python -m pycodestyle sca
python -m mypy sca
python -m compileall -q sca
python -m build
python -m twine check --strict dist/*
```

Python 3.11 is the compatibility floor. `pyproject.toml` is the authoritative package and dependency declaration.

Release history is kept in [`CHANGELOG.md`](https://github.com/zbalkan/wazuhscatune/blob/main/CHANGELOG.md).

## License

GNU General Public License v3 or later. See `LICENSE`.
