What is SCA?
SCA is a Wazuh feature that scans an endpoint and compares its current configuration against industry security standards. Examples of those standards include CIS Benchmarks, PCI DSS, NIST SP 800-53, and ISO 27001. The agent runs through hundreds of checks automatically and returns a result for each one — passed, failed, or not applicable — along with a compliance score and a full breakdown of what's correctly configured and what isn't.
Why Does it Matter?
Think of it like a building inspection before you open the doors. Before you worry about catching intruders, you want to know whether the locks are working, the alarms are connected, and the windows are closed. SCA answers those questions for a computer.
The goal is to reduce the attack surface — fewer gaps means fewer ways in, and fewer ways for an attacker to operate undetected once inside.
How it Connects to Detection
Detection rules only work as well as the data underneath them. If Windows isn't configured to log certain events, no rule can ever fire on them because the raw data simply doesn't exist.
A practical example: one of the failed checks found during the SCA was Audit Process Creation. Windows was not logging new process launches. Every process-based detection rule depends on those events existing in the first place. The rule can be written correctly, the logic sound — but with nothing to match against, it fires on nothing.
The pipeline looks like this:
SCA identifies the gap → Configuration is fixed → Windows now logs the right events → Sysmon captures them with rich detail → Wazuh rules fire on them → Alert reaches the analyst
SCA is what ensures the foundation is solid before detection is built on top of it.
The Three Layers
There are three distinct layers to endpoint security, each building on the other:
- Assess — benchmark the endpoint, understand the gaps.
- Harden — fix the gaps, reduce the attack surface, improve the quality of data being generated.
- Detect — deploy detection rules on a solid foundation, monitor continuously, alert on threats.
Skipping straight to detection without addressing the foundation means building on ground that hasn't been prepared.