SCA vs CIS-CAT

[Srikar Naramsetty]

Hi,

I was trying to get the CIS score for my instances. In wazuh I see 2 menu's SCA and CIS-CAT. 
CIS-CAT PRO is licensed and cost ~3500$, but wazuh already have rules for SCA.

 
My question is if Wazuh already have the CIS rules in SCA and it can generate a events and score for CIS benchmark. What is the need for CIS-CAT?

Thanks,
Srikar

[Luis Enrique Chico Capistrano]

Hi Srikar,

Thank you for reaching out to us with your question.

CIS:
CIS Benchmarks: These are recognized global best practices for securing IT systems and data against cyberattacks, developed by the Center for Internet Security (CIS). Wazuh supports a range of CIS Benchmarks through its Security Compliance Automation (SCA) module.
SCA Module: This built-in Wazuh module helps assess system configurations against chosen CIS Benchmarks, generates corresponding alerts and events, and calculates a compliance score.

CIS-CAT:
Dedicated Compliance Assessment Tool: This is a separate software application, offered by CIS, specifically designed for comprehensive configuration assessment against CIS Benchmarks. It's available in both free and paid (Pro) versions.
Integration with Wazuh: Wazuh offers integration with CIS-CAT Pro, allowing it to utilize the CIS-CAT engine for deeper scanning and reporting while leveraging Wazuh's agent deployment and alert management capabilities.

Key Differences:
Scope: CIS encompasses various benchmarks spanning different technology areas, while CIS-CAT focuses solely on configuration assessment against specific benchmarks.
Functionality: SCA provides basic CIS compliance assessment within Wazuh, while CIS-CAT Pro offers more granular checks, vulnerability scanning (paid version), and advanced reporting features.
Integration: While both support CIS Benchmarks, Wazuh integrates with CIS-CAT Pro to enhance its capabilities, whereas CIS-CAT stands as a separate tool.

In summary, CIS refers to the broader set of best practices and benchmarks, while CIS-CAT is a specific tool for in-depth compliance assessment. Wazuh integrates with CIS-CAT Pro to combine its functionalities, providing a powerful hybrid approach for organizations prioritizing comprehensive security compliance.

Please let us know if you have any further questions or if there's anything else we can assist you with.

Best regards,
Luis