Reading and Remediating Wazuh SCA Findings on macOS

1. Anatomy of an SCA Finding

Location: Endpoint Security → Configuration Assessment

A single check can map to multiple compliance frameworks simultaneously.

2. Parsing CIS Remediation Text

2.1 The % symbol

Represents a terminal prompt. Never part of the actual command.

2.2 Applicability tags

Remediation text is frequently followed by a scope/category label with no delimiter (e.g. Internal Only, External, General, Enterprise, macOS Only). These are not part of the command syntax.

2.3 Parsing rules

3. Remediation Methods

Use the Profile Method when the setting lives inside an NSUserDefaults domain not exposed through any GUI toggle.

4. Terminal Method: Procedure

1. Parse the remediation text per Section 2.
2. Identify each discrete command (one per %).
3. Run each command with sudo individually.
4. Confirm no command is destructive to data you need before executing (rm, overwrite operations, etc.).
5. Proceed to Section 7 (Verification).

5. Profile Method: Procedure

5.1 Identify the payload parameters

From the remediation text, extract:

5.2 Build the profile

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>{payload-type}</string>
            <key>PayloadIdentifier</key>
            <string>{reverse-dns-identifier}</string>
            <key>PayloadUUID</key>
            <string>{generate-with-uuidgen}</string>
            <key>PayloadEnabled</key>
            <true/>
            <key>PayloadDisplayName</key>
            <string>{display-name}</string>
            <key>{setting-key}</key>
            <!-- value type depends on the setting: <true/>, <false/>, <integer>N</integer>, <string>...</string> -->
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>{profile-display-name}</string>
    <key>PayloadIdentifier</key>
    <string>{reverse-dns-identifier}</string>
    <key>PayloadUUID</key>
    <string>{generate-with-uuidgen}</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadScope</key>
    <string>System</string>
</dict>
</plist>

5.3 Installation steps

1. Generate two UUIDs:

   uuidgen
   

2. Replace both {generate-with-uuidgen} placeholders with the generated values.
3. Save the file with a .mobileconfig extension.
4. Double-click the file. This opens System Settings → Profiles.
5. Select the profile, click Install, and authenticate.
6. Proceed to Section 7 (Verification).

6. Deprecated Controls

Some checks target subsystems Apple has deprecated or restricted at the OS level.

Indicators: - The remediation command fails with an OS-level error (e.g. Input/output error) rather than a syntax or permissions error. - The check's own Description field states the underlying feature is deprecated. - Both legacy and modern command syntax (e.g. launchctl load and launchctl bootstrap) produce the identical failure.

Handling: 1. Do not repeatedly retry alternate syntaxes once the same underlying error is confirmed. 2. Document the check as a known exception, including the exact error output. 3. Check the Description field for a vendor-recommended alternative control. 4. If no alternative exists, record the check as accepted risk or out of scope for this OS version.

7. Verification Procedure

Apply after any remediation (Terminal or Profile method):

1. Re-run the exact check command from the finding detail in Terminal to confirm the value changed.
2. Force a fresh SCA scan:

   sudo /Library/Ossec/bin/wazuh-control restart
   

3. Reload the Wazuh dashboard and confirm the check ID moved from Failed to Passed.

8. Automating Remediation

The Wazuh SCA module detects and reports only; it does not remediate automatically.

1. Write a remediation script containing the desired fix commands.
2. Deploy the script via Wazuh's Command / Active Response module.
3. Configure the script to run on a schedule and/or on agent restart.
4. Wazuh triggers a re-scan and updates compliance status.

Which checks to remediate remains an operator decision; the script executes only what it is written to execute.

9. Scaling to a Fleet: MDM

Manual remediation applies per endpoint. In a managed environment, the same .mobileconfig payloads are uploaded once into an MDM (Jamf, Kandji, Mosyle, or Apple Business Manager plus a compatible MDM) and pushed automatically to all enrolled devices, with compliance re-checked continuously. Profile content is identical between manual and MDM deployment; only the distribution mechanism changes.

10. Resources and Repositories