Xor290/ansible-mln
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update

Browse Source
This commit is contained in:
Xor290
2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/security/wazuh/config/wazuh_manager/decoders/modsecurity_decoder.xml
Executable
+4
View File
@@ -0,0 +1,4 @@
<!-- ModSecurity decoder — non utilisé, remplacé par règles json+location -->
<decoder name="waf-modsec-unused">
<prematch>UNUSED_MODSEC_PLACEHOLDER_NEVER_MATCHES</prematch>
</decoder>
monitoring/security/wazuh/config/wazuh_manager/decoders/wireguard-decoder.xml
+45
View File
@@ -0,0 +1,45 @@
<!-- WireGuard Decoders
Parent: kernel (built-in, program_name=^kernel)
Decoders enfants directs de kernel (Wazuh: 2 niveaux max) -->
<decoder name="wireguard-handshake-init">
<parent>kernel</parent>
<prematch>wireguard: wg0: Sending handshake initiation</prematch>
<regex type="pcre2">wireguard: wg0: Sending handshake initiation to peer (\d+) \(([\d.]+):\d+\)</regex>
<order>id,srcip</order>
</decoder>
<decoder name="wireguard-handshake-resp-sent">
<parent>kernel</parent>
<prematch>wireguard: wg0: Sending handshake response</prematch>
<regex type="pcre2">wireguard: wg0: Sending handshake response to peer (\d+) \(([\d.]+):\d+\)</regex>
<order>id,srcip</order>
</decoder>
<decoder name="wireguard-handshake-resp-recv">
<parent>kernel</parent>
<prematch>wireguard: wg0: Receiving handshake response</prematch>
<regex type="pcre2">wireguard: wg0: Receiving handshake response from peer (\d+) \(([\d.]+):\d+\)</regex>
<order>id,srcip</order>
</decoder>
<decoder name="wireguard-keepalive">
<parent>kernel</parent>
<prematch>wireguard: wg0: </prematch>
<regex type="pcre2">wireguard: wg0: \S+ keepalive packet \S+ peer (\d+) \(([\d.]+):\d+\)</regex>
<order>id,srcip</order>
</decoder>
<decoder name="wireguard-timeout">
<parent>kernel</parent>
<prematch>wireguard: wg0: Handshake for peer</prematch>
<regex type="pcre2">wireguard: wg0: Handshake for peer (\d+)[^(]+\(([\d.]+):\d+\).+retrying \(try (\d+)\)</regex>
<order>id,srcip,extra_data</order>
</decoder>
<decoder name="wireguard-roaming">
<parent>kernel</parent>
<prematch>wireguard: wg0: Peer </prematch>
<regex type="pcre2">wireguard: wg0: Peer (\d+).+roaming to ([\d.]+):\d+</regex>
<order>id,srcip</order>
</decoder>