Learn Wazuh - Compliance: GDPR, NIST, HIPAA, PCI DSS

#Introduction

In episode 10, you learned to assess host configuration with the SCA module and read compliance scores against CIS benchmarks. That score is valuable, but it doesn't yet answer one big question: whether you're meeting the regulatory obligations binding your business.

Episode 11 covers compliance. We'll see how Wazuh maps every alert to world-recognized standards, from GDPR in Europe, NIST 800-53 in the United States, HIPAA for healthcare, to PCI DSS for the payments industry and TSC for technology controls.

We'll also discuss the built-in compliance module, custom mapping for special needs, generating compliance reports in the dashboard, and how to export data ready for audit. By the end of this episode, you'll have the tools to honestly explain your organization's compliance position.

#Why Compliance Is Mandatory

Compliance isn't just a legal matter; it's also a language shared between technical teams, management, and auditors. Regulations set obligations, and those obligations translate into measurable controls.

When Wazuh generates an alert, that alert is actually evidence that a control is working. This evidence is what auditors ask for when assessing whether an organization complies with a standard. Without evidence, compliance claims are just empty words.

The problem is that a single event can be relevant to many standards at once. A failed login attempt can touch GDPR, PCI DSS, and NIST simultaneously. Wazuh solves this by tagging every alert with compliance group labels.

#Frameworks Supported by Wazuh

Wazuh provides built-in mappings for five main frameworks. Each has its own identity and evidence requirements.

GDPR governs the protection of EU citizens' personal data. Relevant controls include breach logging and authentication.
NIST 800-53 is a security controls catalog for federal systems, but is widely adopted as an industry standard.
HIPAA governs healthcare data security. Its focus is on the confidentiality and integrity of patient information.
PCI DSS applies to organizations processing payment cards, with an emphasis on monitoring and tracking access.
TSC is the Trust Services Criteria used in SOC audits, covering security, availability, and confidentiality controls.

These mappings aren't a claim of full compliance. Wazuh helps prove that security activity is happening, while the final compliance decision stays with the auditor.

#How Rules Are Mapped to Standards

Every Wazuh rule can carry one or more labels in its group section. These labels take the form of standard codes like gdpr_IV_35.7.d or pci_dss_10.2.4, and that's the bridge between alerts and frameworks.

When an event matches a rule, all those labels attach to the alert. The dashboard then groups alerts by framework, so you can see exactly which events touch GDPR, for example.

Note the comma at the end of each group list. That format is deliberate, because it marks the end of one group. Without the trailing comma, the rule could fail to load and analysis would stop.

<rule id="5715" level="0" overwrite="yes">
  <match>Failed password for invalid user</match>
  <description>SSHD: failed password</description>
  <group>gdpr_IV_35.7.d,gdpr_IV_32.2,nist_800_53_AU.14,</group>
  <group>pci_dss_10.2.4,pci_dss_10.2.5,hipaa_164.312.b,</group>
</rule>

#The Built-in Compliance Module

Wazuh provides a compliance module that summarizes all tagged alerts in one place. In the dashboard, you can see charts and alert lists already grouped per framework, complete with the rules that played a role.

This module filters alerts using group labels, so there's no need to search one by one. You just pick the framework you want to review, then browse the available evidence for a given period.

This feature is very useful when an auditor asks for example incidents from the last three months. Everything already recorded by correctly-labeled rules can be presented in seconds.

#Custom Mapping

Every organization's needs differ, and built-in labels sometimes don't fit internal policy. For that, Wazuh supports custom mapping: you rewrite a rule with overwrite or add a new rule, then attach the desired compliance groups.

The first approach is modifying a built-in rule by writing the same id with the overwrite="yes" attribute, as in the example above. Fields that aren't mentioned keep their old values, so you only write what you want to change.

The second approach is creating a new rule that catches a specific event, then labeling it with the relevant standard's groups. When done, test the change with the wazuh-analysisd -t command to ensure there are no syntax errors before restarting the service.

#Compliance Reports in the Dashboard

Besides viewing alerts, you also need to produce official reports. The Wazuh Dashboard has a reporting tool that generates PDF or CSV documents from the currently displayed search results.

Reports can be created once or scheduled to repeat, for example at the end of every month. This saves the time usually spent assembling evidence manually before an audit.

When putting a report together, set a clear time period and choose the right filters, for example by a specific framework label. The report title and description should mention the standard and scope, so an auditor immediately understands the context.

#Exporting Data for Audit

Audits don't always use finished documents. Sometimes auditors ask for raw data to analyze with their own tools. For that you need to export events from Wazuh.

The API provides direct access to stored events. You can filter by group label, limit the amount, then save the results as a JSON file to give to the auditor.

curl -sk -u wazuh-wui:secret \
  "https://localhost:55000/events?limit=100&q=rule.groups:gdpr" \
  -o gdpr_events.json

Note that the credentials used in the example above should be replaced with a dedicated account that only has read rights to compliance data. Never use admin credentials for routine exports.

#Conclusion

Episode 11 covered how Wazuh translates alerts into compliance evidence. We understand rule mapping to GDPR, NIST 800-53, HIPAA, PCI DSS, and TSC, the built-in compliance module, custom mapping for special needs, dashboard reports, and data export for audit.

Key takeaways:

Every rule can carry many compliance group labels at once.
Five main frameworks are supported: GDPR, NIST 800-53, HIPAA, PCI DSS, and TSC.
The compliance module summarizes tagged alerts in one place.
Custom mapping uses overwrite for built-in rules or creates new rules.
PDF and CSV reports can be generated on demand or scheduled.
The API is the path for exporting raw data to auditors.

The compliance evidence is neatly organized, now it's time to broaden our horizons. In episode 12, we'll take Wazuh to the cloud and discuss AWS, Azure, and GCP integration. See you there!