What Security Compliance checks

Security Compliance is built on Wazuh, an open-source security tool. The Wazuh agent you install inside a node watches it and sends what it finds to E2E’s compliance server. MyAccount shows the results in six views, in three groups. Security events and Integrity monitoring sit under Security Information Management. Threat Detection And Response holds Vulnerabilities and MITRE ATT&CK. Regulatory Compliance holds PCI DSS and HIPAA.

What the views draw on

Every view shows what active agents report. An active agent is one that is connected and reporting now. An agent that has disconnected or never connected adds nothing until it becomes active. The views cover up to the last 90 days.

The views report events, changes, and vulnerabilities on a node. The dashboard does not show checks of an operating system’s settings against a hardening or configuration policy. To read the views, see Read the Security Compliance dashboard.

Security events and rule levels

Security events collects the alerts the agents raise from what happens on the node. Look here for threats and other issues. It counts failed and successful logins separately, so a run of failed logins stands out.

Each alert carries a rule level from Wazuh’s rule classification. A higher number means a more serious event, and Level 12 or above alerts counts the most serious ones. Wazuh’s rules classification describes what each level means.

Integrity monitoring

Integrity monitoring reports changes to files on the node. It lists files added, modified, and deleted, and changes to a file’s permissions, content, ownership, and attributes. It shows which users made the changes and when. Use it to spot a change to a system or settings file that you expect to stay the same.

To change which files and directories the agent watches, and how often it scans them, see What you can change inside the node.

Vulnerabilities

Vulnerabilities shows which of a node’s installed packages have publicly known flaws. Each vulnerability has an ID, a score, and a severity: Critical, High, Medium, or Low. The view covers one node at a time. Wazuh’s vulnerability detection explains how the agent’s list of installed packages is matched against known vulnerabilities.

MITRE ATT&CK

MITRE ATT&CK sorts your security events by the tactics and techniques they match in MITRE ATT&CK. MITRE ATT&CK is a public knowledge base of how attackers work, built from what has been seen in real attacks. A tactic is the attacker’s goal, such as gaining access. A technique is how they go about it. The view shows which tactics your nodes see most, and on which node.

PCI DSS and HIPAA

These two views chart your alerts against each standard, by the requirement they relate to:

• PCI DSS is the global security standard for anyone who processes, stores, or sends payment card data.
• HIPAA, the Health Insurance Portability and Accountability Act of 1996, sets privacy and security rules for medical information.

To see how Wazuh relates its checks to each standard, read Wazuh’s guides for PCI DSS and HIPAA.

What you can change inside the node

The agent’s own configuration file sets what it watches: /var/ossec/etc/ossec.conf on a Linux node. Security Compliance adds no settings of its own, so you change the agent’s behavior there, as Wazuh’s documentation describes:

• Which files and directories integrity monitoring watches and leaves out, and whether it checks in real time or on a schedule: File integrity monitoring.
• The scans of installed packages and other system details: System inventory.
• Linux audit rules, to watch commands run as root or access to a directory: System calls monitoring.
• Every setting in the file: Local configuration.

After you change the file, restart the agent so the change takes effect:

systemctl restart wazuh-agent

E2E runs the compliance server, with its shared agent configuration, rules, and decoders. The settings you control are the agent’s own, on your node.