SCA refactor tier 1

[davidjiglesias]

Description

This issue tracks the porting of the Security Compliance Assessment (SCA) module to the new agent architecture. This involves refactoring the existing module to leverage the new agent's capabilities, including persistent state, stateful/stateless messaging, and alignment with the new data model.

Functional Requirements

• The agent must maintain a persistent internal state.
• This state must be synchronized to the Indexer via stateful messages.
• The module must report check result change events via stateless messages.
• The module must execute scans periodically, with configurable intervals.
• Existing 4.x policies must be supported (same format).
• Policy execution behavior must remain consistent with 4.x.
• The module must support graceful shutdown during scans.
• Initial policy development for the following operating systems:
  • Amazon Linux 2023
  • Ubuntu 24.04
  • macOS 15 Sequoia
  • Windows 11

Non-Functional Requirements

• The module must function on Tier 1 supported operating systems.
• Data stored in the internal state and reported to the server must conform to ECS schema.

Implementation Restrictions

• The internal state must be implemented using the DBsync library.
• Policies are assumed to be present on the agent (may be revisited).
• The module will be developed from scratch:
  • C++ 20 and coroutines.
  • Leverage code from the existing 4.x implementation.

Testing

• Comprehensive integration tests will be developed to ensure the module functions correctly within the new agent framework and across supported operating systems.

Plan

1. Design the SCA module architecture.
2. Design the necessary configuration schema.
3. Design the database schema for DBsync.
4. Implement the configuration parser.
5. Develop the SCA module:
   a. Implement a coroutine for parsing SCA policies (YAML).
   b. Implement a coroutine for scan execution.
   c. Integrate the module with DBsync.
   d. Develop initial policies.
6. Create integration tests.
7. Add development documentation.

Future Lines (Tier 2)

• Agent-side policy retrieval.
• Policy signing.
• Determine default out-of-the-box policies.
• Management API: SCA endpoints.
• Content Manager extension.
• SCA Provider implementation.

Let me know if you'd like any adjustments or additions to this issue!