Status changed from 'not applicable' to passed · sca.check.previous_result = not applicable

Description

$(sca.policy): $(sca.check.title): Status changed from 'not applicable' to passed

Query · wazuh

field sca.check.previous_result="^not applicable"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 19000 Group of Security Configuration Assessment rules anchor level 0
    decoded_as=sca
  2. 19006 Security Configuration Assessment: check event anchor level 0
    field sca.type="^check"
  3. 19008 sca rule 19008 · sca.check.result = passed anchor level 3
    field sca.check.result="^passed"
  4. 19015 Status changed from 'not applicable' to passed · sca.check.previous_result = not applicable refinement level 3 this rule
    field sca.check.previous_result="^not applicable"

Rule dependencies

Depends on

Raw source Status changed from 'not applicable' to passed · sca.check.previous_result = not applicable · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="19015" level="3">
    <if_sid>19008</if_sid>
    <field name="sca.check.previous_result">^not applicable</field>
    <options>no_full_log</options>
    <description>$(sca.policy): $(sca.check.title): Status changed from 'not applicable' to passed</description>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.