Normalize stateless check fields by MAnDumu · Pull Request #35404 · wazuh/wazuh

MAnDumu · 2026-04-13T00:46:41Z

Description

This pull request addresses missing and inconsistent normalized SCA fields in stateless events, as identified in issue #35281.

It implements normalization for legacy title fields and improves MITRE field normalization in stateless SCA payloads to keep consistency with current schema expectations.

Closes #35281

During validation, this PR also incorporated Windows SCA integration stabilization and Windows CI workflow behavior fixes required to make the normalization changes consistently verifiable in CI. These additions are part of the final delivered scope.

Proposed Changes

Added legacy compatibility normalization from title to name:
check.title -> check.name
requirements.title -> requirements.name
policy.title -> policy.name
Updated stateless changed_fields generation to report normalized paths:
check.title is reported as check.name
requirements.title is reported as requirements.name
policy.title is reported as policy.name
Improved MITRE normalization in check payload:
Converts mitre.tactic, mitre.technique, and mitre.subtechnique from string CSV values to arrays
Removes invalid MITRE subfield types to keep schema alignment
Added unit tests to validate all new normalization behavior and priority rules between name and title

Additional scope included in this PR

Stabilized Windows SCA integration tests (startup synchronization, timeout increases, log polling fallbacks, callback result handling, DB lock cleanup retries, and controlled fallback/xfail for known runner inconsistencies).
Updated Windows CI no-relevant-changes behavior (detect-changes naming, skip path support, and clearer skipped-job reporting).
Updated SCA test policy fixtures from legacy title fields to canonical name fields where applicable.

Results and Evidence

Automated test evidence:

Targeted SCA event handler suite executed successfully:
ctest -R SCAEventHandlerTest --output-on-failure
Result: 100% tests passed, 0 tests failed

Additional checks covered by new tests:

title -> name normalization in check, requirements and policy payloads
name priority when both name and title are present
changed_fields normalization to check.name and policy.name
MITRE subfield normalization to arrays
Final CI validation includes successful Windows runs after the stabilization updates.
Comparative evidence uses representative indexed SCA events (summary vs check shapes) captured from the available environment data.

Artifacts Affected

SCA module source code
SCA module unit tests
SCA integration tests
SCA test policy fixtures
Windows CI workflow definitions
No package format changes
No default configuration file changes

Configuration Changes

None

Documentation Updates

None

Tests Introduced

New unit tests in src/wazuh_modules/sca/sca_impl/tests/sca_event_handler_test.cpp:

ProcessStateless_NormalizesTitleInChangedFields
NormalizeCheck_TitleToName
NormalizeCheck_NameHasPriorityOverTitle
NormalizePolicy_TitleToName
NormalizePolicy_NameHasPriorityOverTitle

Also includes MITRE normalization test coverage extensions in the same test suite.

Diff between jsons stateful and stateless

Stateful

old:
---
{
  "_index": "wazuh-states-sca",
  "_id": "wazuh_001_f55e624cf1d6de9696f3c0f3291be60860551930",
  "_source": {
    "wazuh": {
      "agent": {
        "name": "DESKTOP-011KDNM",
        "id": "001"
      }
    },
    "check": {
      "id": "15971",
      "title": "Ensure 'Remove access to \"Pause updates\" feature' is set to 'Enabled'.",
      "result": "Failed",
      "condition": "all",
      "description": "This policy removes access to \"Pause updates\" feature. The recommended state for this setting is: Enabled.",
      "rationale": "In order to ensure security and system updates are applied, system administrators should control when updates are applied to systems.",
      "remediation": "To establish the recommended configuration via GP, set the following UI path to Enabled: ...",
      "mitre": {
        "technique": "T1595,T1190,T1203",
        "tactic": "TA0043,TA0007"
      },
      "compliance": {
        "iso_27001": ["A.12.6.1", "A.12.5.1"],
        "hipaa": ["164.308(a)(1)", "164.308(a)(8)"],
        "pci_dss": ["6.2"],
        "tsc": ["CC7.1", "CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC7.2", "CC7.3", "CC7.4", "CC7.5", "CC4.1", "CC4.2"],
        "nis2": ["21.2.f", "21.2.a"],
        "nist_800_171": ["3.14.1"],
        "fedramp": ["SI-2"],
        "nist_800_53": ["SI-2"],
        "cmmc": ["SI.L2-3.14.1"],
        "gdpr": ["32", "35"]
      }
    },
    "state": {
      "modified_at": "2026-04-21T02:23:07.075Z"
    },
    "policy": {
      "id": "cis_win10_enterprise",
      "name": "CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0",
      "file": "cis_win10_enterprise.yml",
      "description": "This document provides prescriptive guidance...",
      "references": ["[\"https://www.cisecurity.org/cis-benchmarks/\"]"]
    }
  }
}

new:
---
{
  "_index": "wazuh-states-sca",
  "_id": "wazuh_001_f55e624cf1d6de9696f3c0f3291be60860551930",
  "_source": {
    "wazuh": {
      "agent": {
        "name": "DESKTOP-011KDNM",
        "id": "001"
      }
    },
    "check": {
      "id": "15971",
      "name": "Ensure 'Remove access to “Pause updates” feature' is set to 'Enabled'.",
      "result": "Failed",
      "condition": "all",
      "description": "This policy removes access to \"Pause updates\" feature. The recommended state for this setting is: Enabled.",
      "rationale": "In order to ensure security and system updates are applied, system administrators should control when updates are applied to systems.",
      "remediation": "To establish the recommended configuration via GP, set the following UI path to Enabled: Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage end user experience\\Remove access to \"Pause updates\" feature Note: This Group Policy path is provided by the Group Policy template WindowsUpdate.admx/adml that is included with the Microsoft Windows 10 Release 1809 & Server 2019 Administrative Templates (or newer).",
      "mitre": {
        "technique": ["T1595", "T1190", "T1203"],
        "tactic": ["TA0043", "TA0007"]
      },
      "compliance": {
        "iso_27001": ["A.12.6.1", "A.12.5.1"],
        "hipaa": ["164.308(a)(1)", "164.308(a)(8)"],
        "pci_dss": ["6.2"],
        "tsc": ["CC7.1", "CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC7.2", "CC7.3", "CC7.4", "CC7.5", "CC4.1", "CC4.2"],
        "nis2": ["21.2.f", "21.2.a"],
        "nist_800_171": ["3.14.1"],
        "fedramp": ["SI-2"],
        "nist_800_53": ["SI-2"],
        "cmmc": ["SI.L2-3.14.1"],
        "gdpr": ["32", "35"]
      }
    },
    "state": {
      "modified_at": "2026-04-21T02:23:07.075Z"
    },
    "policy": {
      "id": "cis_win10_enterprise",
      "name": "CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0",
      "file": "cis_win10_enterprise.yml",
      "description": "This document provides prescriptive guidance for establishing a secure configuration posture for Microsoft Windows 10 Enterprise. Please note that the rules provide accurate results for Windows 10 Operating Systems with the System language set to English. The SCA policy will work with other languages but the results will be less accurate due to some of the rules that depend on the System language.",
      "references": ["[\"https://www.cisecurity.org/cis-benchmarks/\"]"]
    }
  }
}

--------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------

Stateless

old:
---
{
  "_index": ".ds-wazuh-events-v5-security-000001",
  "_id": "AlnZrZ0BXqOxwuoKTIWc",
  "_source": {
    "@timestamp": "2026-04-21T02:23:07.561Z",
    "wazuh": {
      "agent": {
        "name": "DESKTOP-011KDNM",
        "id": "001"
      }
    },
    "event": {
      "kind": "event",
      "action": "modified",
      "category": ["configuration"],
      "type": ["change"],
      "dataset": "wazuh.sca",
      "outcome": "unknown"
    },
    "check": {
      "id": "15894",
      "title": "Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days'.",
      "result": "Not applicable",
      "condition": "all",
      "description": "This policy setting controls...",
      "rationale": "Quality Updates can contain important bug fixes...",
      "remediation": "To establish the recommended configuration via GP...",
      "mitre": {
        "technique": "T1595,T1190,T1203",
        "tactic": "TA0043,TA0007"
      },
      "compliance": {
        "iso_27001": ["A.12.6.1", "A.12.5.1"],
        "hipaa": ["164.308(a)(1)", "164.308(a)(8)"],
        "pci_dss": ["6.2"],
        "tsc": ["CC7.1", "CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC7.2", "CC7.3", "CC7.4", "CC7.5", "CC4.1", "CC4.2"],
        "nis2": ["21.2.f", "21.2.a"],
        "nist_800_171": ["3.14.1"],
        "fedramp": ["SI-2"],
        "nist_800_53": ["SI-2"],
        "cmmc": ["SI.L2-3.14.1"],
        "gdpr": ["32", "35"]
      }
    },
    "policy": {
      "id": "cis_win10_enterprise",
      "name": "CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0",
      "file": "cis_win10_enterprise.yml",
      "description": "This document provides prescriptive guidance...",
      "references": ["[\"https://www.cisecurity.org/cis-benchmarks/\"]"]
    }
  }
}

new:
---
{
  "_index": ".ds-wazuh-events-v5-security-000001",
  "_id": "AlnZrZ0BXqOxwuoKTIWc",
  "_source": {
    "@timestamp": "2026-04-21T02:23:07.561Z",
    "wazuh": {
      "agent": {
        "name": "DESKTOP-011KDNM",
        "id": "001"
      }
    },
    "event": {
      "kind": "event",
      "action": "modified",
      "category": ["configuration"],
      "type": ["change"],
      "dataset": "wazuh.sca",
      "outcome": "unknown"
    },
    "check": {
      "id": "15894",
      "name": "Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days'.",
      "result": "Not applicable",
      "condition": "all",
      "description": "This policy setting controls whether devices are able to receive optional updates (including Controlled Feature Rollout (CFRs)). These optional updates can include non-security updates, feature enhancements, and other improvements. The recommended state for this setting is: Disabled.",
      "rationale": "Quality Updates can contain important bug fixes and/or security patches, and should be installed as soon as possible.",
      "remediation": "To establish the recommended configuration via GP, set the following UI path to Enabled:0 days: Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage updates offered from Windows Update\\Select when Quality Updates are received Note: Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WindowsUpdate.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative Templates (or newer).",
      "mitre": {
        "technique": ["T1595", "T1190", "T1203"],
        "tactic": ["TA0043", "TA0007"]
      },
      "compliance": {
        "iso_27001": ["A.12.6.1", "A.12.5.1"],
        "hipaa": ["164.308(a)(1)", "164.308(a)(8)"],
        "pci_dss": ["6.2"],
        "tsc": ["CC7.1", "CC3.1", "CC3.2", "CC3.3", "CC3.4", "CC7.2", "CC7.3", "CC7.4", "CC7.5", "CC4.1", "CC4.2"],
        "nis2": ["21.2.f", "21.2.a"],
        "nist_800_171": ["3.14.1"],
        "fedramp": ["SI-2"],
        "nist_800_53": ["SI-2"],
        "cmmc": ["SI.L2-3.14.1"],
        "gdpr": ["32", "35"]
      }
    },
    "policy": {
      "id": "cis_win10_enterprise",
      "name": "CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0",
      "file": "cis_win10_enterprise.yml",
      "description": "This document provides prescriptive guidance for establishing a secure configuration posture for Microsoft Windows 10 Enterprise. Please note that the rules provide accurate results for Windows 10 Operating Systems with the System language set to English. The SCA policy will work with other languages but the results will be less accurate due to some of the rules that depend on the System language.",
      "references": ["[\"https://www.cisecurity.org/cis-benchmarks/\"]"]
    }
  }
}

Review Checklist

Code changes reviewed
Relevant evidence provided
Tests cover the new functionality
Configuration changes documented
Developer documentation reflects the changes
Meets requirements and/or definition of done
No unresolved dependencies with other issues
Additional requirement: title/name normalization is covered in implementation and tests

- normalize check.mitre.* to arrays in stateless events - map legacy check.title/policy.title to name - normalize changed_fields to use check.name/policy.name - extend SCAEventHandlerTest coverage

…result_for_a_given_id

…at test

…ibility

…ard compatible). All YAMLs and tests use 'name'. Validated with gtests. Requirements parsing and logic are not broken.

MAnDumu linked an issue Apr 13, 2026 that may be closed by this pull request

Analyze missing SCA check fields in Stateless events #35281

Closed

9 tasks

MAnDumu self-assigned this Apr 13, 2026

MAnDumu force-pushed the bug/35281-sca-stateless-check-fields branch from 77b977f to a039df3 Compare April 13, 2026 11:09

MAnDumu requested review from Nicogp and rovogel April 14, 2026 12:07

jpcerrone reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/workflows/5_builderpackage_agent-windows.yml Outdated

Nicogp reviewed Apr 21, 2026

View reviewed changes

Comment thread tests/integration/test_sca/test_basic/test_mitre_payload.py Outdated

Nicogp reviewed Apr 21, 2026

View reviewed changes

Comment thread tests/integration/test_sca/test_basic/test_mitre_payload.py Outdated

Nicogp reviewed Apr 21, 2026

View reviewed changes

Comment thread tests/integration/test_sca/test_basic/test_scan_results.py Outdated

Nicogp reviewed Apr 21, 2026

View reviewed changes

Comment thread tests/integration/test_sca/test_basic/test_validate_remediation.py Outdated

MAnDumu mentioned this pull request Apr 21, 2026

Analyze missing SCA check fields in Stateless events #35281

Closed

9 tasks

MAnDumu requested a review from Nicogp April 21, 2026 17:58

MAnDumu changed the title ~~feat(sca): normalize stateless check fields~~ Normalize stateless check fields Apr 22, 2026

MAnDumu marked this pull request as ready for review April 22, 2026 00:07

MAnDumu force-pushed the bug/35281-sca-stateless-check-fields branch from ecbdc10 to 9a423c1 Compare April 22, 2026 02:31

jpcerrone previously approved these changes Apr 22, 2026

View reviewed changes

MAnDumu added 14 commits April 22, 2026 12:27

feat(sca): normalize stateless check fields

9eaad55

- normalize check.mitre.* to arrays in stateless events - map legacy check.title/policy.title to name - normalize changed_fields to use check.name/policy.name - extend SCAEventHandlerTest coverage

style(sca): fix astyle formatting in event handler tests

90727a5

fix(ci): stabilize Windows IT job names when skipped

968f221

fix(ci): improve Windows IT naming and SCA test logging

b9dfc57

fix(tests): use valid SCA debug level in integration tests

a5b28bd

test(sca): increase scan wait timeout on Windows

5e786e5

test(sca): wait for module startup before scan assertions

3027be3

test(sca): rename title to name in policy sample files

db529a2

test(sca): harden windows db cleanup and mitre capture

161bee5

test(sca): improve windows lock handling and mitre parsing

605253c

test(sca): harden windows startup and db lock retries

ff43b1e

test(sca): stabilize windows setup and first remediation scan

1c7f3d8

ci(windows): simplify no-relevant IT job naming

04c7086

test(sca): handle single-event callback_result as bare tuple in find_…

90842f9

…result_for_a_given_id

MAnDumu added 17 commits April 22, 2026 12:27

test(sca): harden windows scan synchronization and db cleanup

8090305

test(sca): avoid flaky scan start markers on windows

722c07a

test(sca): increase windows timeout and reduce accumulations requirement

8e9d6aa

test(sca): poll windows logs for mitre and remediation events

d5668a0

test(sca): unify linux-only branch in scan results test

1e92795

test(sca): poll windows log for scan results

4883c5a

test(sca): fix windows remediation matching and mitre fallback

34d2105

test(sca): xfail windows mitre log gaps after scan confirmation

4298722

ci(windows): show no changes when integration tests are skipped

5b0b03c

test(sca): relax windows mitre precheck policy matching

42bd9b1

ci(windows): name detect changes job

94b10c9

test(sca): add windows fallback for scan policy label mismatch

9f0cd73

test(sca): harden windows remediation result matching

d54f4c8

test(sca): replace manual log polling with FileMonitor

b93da62

fix(sca): check both stateful and stateless events in compliance form…

ff23d36

…at test

fix(sca): correct ProcessStateless test inputs for result type compat…

381d824

…ibility

fix(sca): align stateless handler tests with operation types

acee776

MAnDumu force-pushed the bug/35281-sca-stateless-check-fields branch from 10fa627 to acee776 Compare April 22, 2026 15:27

MAnDumu dismissed jpcerrone’s stale review via 8c064a5 April 23, 2026 16:24

fix(sca): requirements parser supports both 'name' and 'title' (backw…

9f52d1f

…ard compatible). All YAMLs and tests use 'name'. Validated with gtests. Requirements parsing and logic are not broken.

MAnDumu force-pushed the bug/35281-sca-stateless-check-fields branch from 8c064a5 to 9f52d1f Compare April 23, 2026 16:31

Nicogp approved these changes Apr 23, 2026

View reviewed changes

Nicogp merged commit 33bcae8 into main Apr 23, 2026
99 of 103 checks passed

Nicogp deleted the bug/35281-sca-stateless-check-fields branch April 23, 2026 19:21

Navigation Menu

Normalize stateless check fields - #35404

Normalize stateless check fields#35404
Nicogp merged 32 commits into
mainfrom
bug/35281-sca-stateless-check-fields

MAnDumu commented Apr 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

MAnDumu commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Proposed Changes

Additional scope included in this PR

Results and Evidence

Artifacts Affected

Configuration Changes

Documentation Updates

Tests Introduced

Diff between jsons stateful and stateless

Review Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MAnDumu commented Apr 13, 2026 •

edited

Loading