961 lines
36 KiB
Plaintext
Executable File
961 lines
36 KiB
Plaintext
Executable File
<ossec_config>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
GLOBAL
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<global>
|
|
<jsonout_output>yes</jsonout_output>
|
|
<alerts_log>yes</alerts_log>
|
|
<logall>no</logall>
|
|
<logall_json>no</logall_json>
|
|
<email_notification>no</email_notification>
|
|
<agents_disconnection_time>10m</agents_disconnection_time>
|
|
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
|
|
</global>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
ALERTES
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<alerts>
|
|
<log_alert_level>3</log_alert_level>
|
|
</alerts>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
LOGGING
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<logging>
|
|
<log_format>plain</log_format>
|
|
</logging>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
COMMUNICATION AGENTS (port 1514 TCP)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<remote>
|
|
<connection>secure</connection>
|
|
<port>1514</port>
|
|
<protocol>tcp</protocol>
|
|
<queue_size>131072</queue_size>
|
|
</remote>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
POLICY MONITORING
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<rootcheck>
|
|
<disabled>no</disabled>
|
|
<check_files>yes</check_files>
|
|
<check_trojans>yes</check_trojans>
|
|
<check_dev>yes</check_dev>
|
|
<check_sys>yes</check_sys>
|
|
<check_pids>yes</check_pids>
|
|
<check_ports>yes</check_ports>
|
|
<check_if>yes</check_if>
|
|
<frequency>43200</frequency>
|
|
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
|
|
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
|
<skip_nfs>yes</skip_nfs>
|
|
</rootcheck>
|
|
|
|
<wodle name="cis-cat">
|
|
<disabled>yes</disabled>
|
|
<timeout>1800</timeout>
|
|
<interval>1d</interval>
|
|
<scan-on-start>yes</scan-on-start>
|
|
<java_path>wodles/java</java_path>
|
|
<ciscat_path>wodles/ciscat</ciscat_path>
|
|
</wodle>
|
|
|
|
<wodle name="osquery">
|
|
<disabled>yes</disabled>
|
|
<run_daemon>yes</run_daemon>
|
|
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
|
<config_path>/etc/osquery/osquery.conf</config_path>
|
|
<add_labels>yes</add_labels>
|
|
</wodle>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
SYSTEM INVENTORY
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<wodle name="syscollector">
|
|
<disabled>no</disabled>
|
|
<interval>1h</interval>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<hardware>yes</hardware>
|
|
<os>yes</os>
|
|
<network>yes</network>
|
|
<packages>yes</packages>
|
|
<ports all="yes">yes</ports>
|
|
<processes>yes</processes>
|
|
<synchronization>
|
|
<max_eps>10</max_eps>
|
|
</synchronization>
|
|
</wodle>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
SECURITY CONFIGURATION ASSESSMENT
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<sca>
|
|
<enabled>yes</enabled>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<interval>12h</interval>
|
|
<skip_nfs>yes</skip_nfs>
|
|
</sca>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
VULNERABILITY DETECTION
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<vulnerability-detection>
|
|
<enabled>yes</enabled>
|
|
<index-status>yes</index-status>
|
|
<feed-update-interval>60m</feed-update-interval>
|
|
</vulnerability-detection>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
INDEXER (Wazuh Indexer / OpenSearch)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<indexer>
|
|
<enabled>yes</enabled>
|
|
<hosts>
|
|
<host>https://wazuh.indexer:9200</host>
|
|
</hosts>
|
|
<ssl>
|
|
<certificate_authorities>
|
|
<ca>/etc/ssl/root-ca.pem</ca>
|
|
</certificate_authorities>
|
|
<certificate>/etc/ssl/filebeat.pem</certificate>
|
|
<key>/etc/ssl/filebeat.key</key>
|
|
</ssl>
|
|
</indexer>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
FILE INTEGRITY MONITORING
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<syscheck>
|
|
<disabled>no</disabled>
|
|
<frequency>43200</frequency>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<alert_new_files>yes</alert_new_files>
|
|
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
|
<directories>/etc,/usr/bin,/usr/sbin</directories>
|
|
<directories>/bin,/sbin,/boot</directories>
|
|
<ignore>/etc/mtab</ignore>
|
|
<ignore>/etc/hosts.deny</ignore>
|
|
<ignore>/etc/mail/statistics</ignore>
|
|
<ignore>/etc/random-seed</ignore>
|
|
<ignore>/etc/random.seed</ignore>
|
|
<ignore>/etc/adjtime</ignore>
|
|
<ignore>/etc/httpd/logs</ignore>
|
|
<ignore>/etc/utmpx</ignore>
|
|
<ignore>/etc/wtmpx</ignore>
|
|
<ignore>/etc/cups/certs</ignore>
|
|
<ignore>/etc/dumpdates</ignore>
|
|
<ignore>/etc/svc/volatile</ignore>
|
|
<ignore type="sregex">.log$|.swp$</ignore>
|
|
<nodiff>/etc/ssl/private.key</nodiff>
|
|
<skip_nfs>yes</skip_nfs>
|
|
<skip_dev>yes</skip_dev>
|
|
<skip_proc>yes</skip_proc>
|
|
<skip_sys>yes</skip_sys>
|
|
<process_priority>10</process_priority>
|
|
<max_eps>100</max_eps>
|
|
<synchronization>
|
|
<enabled>yes</enabled>
|
|
<interval>5m</interval>
|
|
<max_interval>1h</max_interval>
|
|
<max_eps>10</max_eps>
|
|
</synchronization>
|
|
</syscheck>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
ACTIVE RESPONSE — WHITELIST
|
|
90.50.148.138 : IP publique admin — jamais bloquée
|
|
90.120.69.13 : IP publique admin — jamais bloquée
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<global>
|
|
<white_list>127.0.0.1</white_list>
|
|
<white_list>^localhost.localdomain$</white_list>
|
|
<white_list>90.50.148.138</white_list>
|
|
<white_list>90.120.69.13</white_list>
|
|
<white_list>10.0.0.3</white_list>
|
|
</global>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
ACTIVE RESPONSE — COMMANDES
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<command>
|
|
<name>disable-account</name>
|
|
<executable>disable-account</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>restart-wazuh</name>
|
|
<executable>restart-wazuh</executable>
|
|
</command>
|
|
|
|
<command>
|
|
<name>firewall-drop</name>
|
|
<executable>firewall-drop</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>host-deny</name>
|
|
<executable>host-deny</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>route-null</name>
|
|
<executable>route-null</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>win_route-null</name>
|
|
<executable>route-null.exe</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>netsh</name>
|
|
<executable>netsh.exe</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>clamav-quarantine</name>
|
|
<executable>clamav-quarantine</executable>
|
|
<timeout_allowed>no</timeout_allowed>
|
|
</command>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
ACTIVE RESPONSE — RÈGLES
|
|
═══════════════════════════════════════════════════════════ -->
|
|
|
|
<!-- SSH mauvais mot de passe → ban PERMANENT (1 tentative suffit) -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_group>authentication_failures</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Échec auth générique → ban PERMANENT -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_group>authentication_failed</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>local</location>
|
|
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<level>7</level>
|
|
<rules_group>web,attack</rules_group>
|
|
<timeout>300</timeout>
|
|
</active-response>
|
|
|
|
<!-- Scan de ports → firewall-drop 1 heure -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>1002,2502,2503,2504</rules_id>
|
|
<timeout>3600</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH brute-force → host-deny PERMANENT (double protection) -->
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>local</location>
|
|
<rules_group>authentication_failures,authentication_failed</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100202,100203,100205</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- ModSecurity RCE / anomalie critique → firewall-drop 24 heures -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100204,100206</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- ClamAV virus détecté → quarantaine du fichier infecté -->
|
|
<active-response>
|
|
<command>clamav-quarantine</command>
|
|
<location>local</location>
|
|
<rules_id>52502</rules_id>
|
|
</active-response>
|
|
|
|
<!-- Attaque soutenue ModSec (5 blocs / 2 min) → firewall-drop 24 heures -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100210</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH brute-force (3 tentatives / 60s) → firewall-drop 1 heure -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100300</rules_id>
|
|
<timeout>3600</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH scan de comptes (3 users inexistants / 60s) → firewall-drop 24 heures -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100301</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- Sudo brute-force (3 échecs / 5 min) → disable-account 2h + firewall-drop 6h -->
|
|
<active-response>
|
|
<command>disable-account</command>
|
|
<location>local</location>
|
|
<rules_id>100310</rules_id>
|
|
<timeout>7200</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100310</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
OWASP Top 10 — Active Response (ModSecurity)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
|
|
<!-- OWASP#3 SQL Injection (100220) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100220</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 SQL Injection brute-force (100290) → firewall-drop 24h + host-deny -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100290</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>local</location>
|
|
<rules_id>100290</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 LDAP Injection (100221) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100221</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 Command Injection (100222) → firewall-drop 24h + host-deny permanent -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100222</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>local</location>
|
|
<rules_id>100222</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 Command Injection brute-force CRITICAL (100292) → permanent ban -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100292</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>local</location>
|
|
<rules_id>100292</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 PHP/Java Injection (100223, 100224) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100223,100224</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#6 RCE / Exploit attempts (100230) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100230</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 XSS attacks (100240) → firewall-drop 4h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100240</rules_id>
|
|
<timeout>14400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 XSS brute-force (100291) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100291</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 HTTP Header Injection (100241) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100241</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Path Traversal / LFI (100250) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100250</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Path Traversal brute-force (100293) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100293</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Remote File Inclusion (100251) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100251</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Restricted File Access (100252) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100252</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#8 XXE (XML External Entity) (100260) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100260</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#9 Scanner Detection (100270) → firewall-drop 2h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100270</rules_id>
|
|
<timeout>7200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP SSRF (100280) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100280</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP File Upload (100281) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>local</location>
|
|
<rules_id>100281</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<disabled>no</disabled>
|
|
<command>host-deny</command>
|
|
<location>all</location>
|
|
<rules_id>100210</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100204,100206</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_group>authentication_failures</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Échec auth générique → ban PERMANENT -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_group>authentication_failed</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>all</location>
|
|
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<level>7</level>
|
|
<rules_group>web,attack</rules_group>
|
|
<timeout>300</timeout>
|
|
</active-response>
|
|
|
|
<!-- Scan de ports → firewall-drop 1 heure -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>1002,2502,2503,2504</rules_id>
|
|
<timeout>3600</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH brute-force → host-deny PERMANENT (double protection) -->
|
|
<active-response>
|
|
<command>host-deny</command>
|
|
<location>all</location>
|
|
<rules_group>authentication_failures,authentication_failed</rules_group>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100202,100203,100205</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH brute-force (3 tentatives / 60s) → firewall-drop 1 heure sur tous les agents -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100300</rules_id>
|
|
<timeout>3600</timeout>
|
|
</active-response>
|
|
|
|
<!-- SSH scan de comptes → firewall-drop 24 heures sur tous les agents -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100301</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
OWASP Top 10 — Active Response (ModSecurity - location=all)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
|
|
<!-- OWASP#3 SQLi (100220) → firewall-drop 6h (tous agents) -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100220</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 SQLi brute-force (100290) → firewall-drop 24h (tous agents) -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100290</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 LDAP (100221) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100221</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 Command Injection (100222) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100222</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 Command Injection CRITICAL (100292) → permanent ban -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100292</rules_id>
|
|
<timeout>0</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#3 PHP/Java (100223, 100224) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100223,100224</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#6 RCE/Exploit (100230) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100230</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 XSS (100240) → firewall-drop 4h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100240</rules_id>
|
|
<timeout>14400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 XSS brute-force (100291) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100291</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#7 Header Injection (100241) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100241</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Path Traversal/LFI (100250) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100250</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 Path Traversal brute-force (100293) → firewall-drop 24h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100293</rules_id>
|
|
<timeout>86400</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 RFI (100251) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100251</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#1 File Access (100252) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100252</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#8 XXE (100260) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100260</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP#9 Scanner (100270) → firewall-drop 2h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100270</rules_id>
|
|
<timeout>7200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP SSRF (100280) → firewall-drop 12h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100280</rules_id>
|
|
<timeout>43200</timeout>
|
|
</active-response>
|
|
|
|
<!-- OWASP File Upload (100281) → firewall-drop 6h -->
|
|
<active-response>
|
|
<command>firewall-drop</command>
|
|
<location>all</location>
|
|
<rules_id>100281</rules_id>
|
|
<timeout>21600</timeout>
|
|
</active-response>
|
|
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
LOG ANALYSIS (commandes système)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<localfile>
|
|
<log_format>command</log_format>
|
|
<command>df -P</command>
|
|
<frequency>360</frequency>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>full_command</log_format>
|
|
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
|
<alias>netstat listening ports</alias>
|
|
<frequency>360</frequency>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>full_command</log_format>
|
|
<command>last -n 20</command>
|
|
<frequency>360</frequency>
|
|
</localfile>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
RULESET
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<ruleset>
|
|
<!-- Règles et decoders natifs Wazuh -->
|
|
<decoder_dir>ruleset/decoders</decoder_dir>
|
|
<rule_dir>ruleset/rules</rule_dir>
|
|
<!-- Règles exclues — non pertinentes pour ce stack -->
|
|
<rule_exclude>0025-sendmail_rules.xml</rule_exclude>
|
|
<rule_exclude>0030-postfix_rules.xml</rule_exclude>
|
|
<rule_exclude>0035-spamd_rules.xml</rule_exclude>
|
|
<rule_exclude>0040-imapd_rules.xml</rule_exclude>
|
|
<rule_exclude>0045-mailscanner_rules.xml</rule_exclude>
|
|
<rule_exclude>0050-ms-exchange_rules.xml</rule_exclude>
|
|
<rule_exclude>0055-courier_rules.xml</rule_exclude>
|
|
<rule_exclude>0065-pix_rules.xml</rule_exclude>
|
|
<rule_exclude>0070-netscreenfw_rules.xml</rule_exclude>
|
|
<rule_exclude>0075-cisco-ios_rules.xml</rule_exclude>
|
|
<rule_exclude>0080-sonicwall_rules.xml</rule_exclude>
|
|
<rule_exclude>0090-telnetd_rules.xml</rule_exclude>
|
|
<rule_exclude>0100-solaris_bsm_rules.xml</rule_exclude>
|
|
<rule_exclude>0105-asterisk_rules.xml</rule_exclude>
|
|
<rule_exclude>0110-ms_dhcp_rules.xml</rule_exclude>
|
|
<rule_exclude>0115-arpwatch_rules.xml</rule_exclude>
|
|
<rule_exclude>0130-trend-osce_rules.xml</rule_exclude>
|
|
<rule_exclude>0135-hordeimp_rules.xml</rule_exclude>
|
|
<rule_exclude>0155-dovecot_rules.xml</rule_exclude>
|
|
<rule_exclude>0160-vmpop3d_rules.xml</rule_exclude>
|
|
<rule_exclude>0165-vpopmail_rules.xml</rule_exclude>
|
|
<rule_exclude>0170-ftpd_rules.xml</rule_exclude>
|
|
<rule_exclude>0175-proftpd_rules.xml</rule_exclude>
|
|
<rule_exclude>0185-vsftpd_rules.xml</rule_exclude>
|
|
<rule_exclude>0190-ms_ftpd_rules.xml</rule_exclude>
|
|
<rule_exclude>0195-named_rules.xml</rule_exclude>
|
|
<rule_exclude>0215-policy_rules.xml</rule_exclude>
|
|
<rule_exclude>0750-github_rules.xml</rule_exclude>
|
|
<rule_exclude>0250-apache_rules.xml</rule_exclude>
|
|
<rule_exclude>0255-zeus_rules.xml</rule_exclude>
|
|
<rule_exclude>0265-php_rules.xml</rule_exclude>
|
|
<rule_exclude>0275-squid_rules.xml</rule_exclude>
|
|
<rule_exclude>0295-mysql_rules.xml</rule_exclude>
|
|
<rule_exclude>0305-dropbear_rules.xml</rule_exclude>
|
|
<rule_exclude>0315-apparmor_rules.xml</rule_exclude>
|
|
<rule_exclude>0350-amazon_rules.xml</rule_exclude>
|
|
<rule_exclude>0360-serv-u_rules.xml</rule_exclude>
|
|
<rule_exclude>0385-oscap_rules.xml</rule_exclude>
|
|
<rule_exclude>0390-fortiddos_rules.xml</rule_exclude>
|
|
<rule_exclude>0391-fortigate_rules.xml</rule_exclude>
|
|
<rule_exclude>0392-fortimail_rules.xml</rule_exclude>
|
|
<rule_exclude>0393-fortiauth_rules.xml</rule_exclude>
|
|
<rule_exclude>0120-symantec-av_rules.xml</rule_exclude>
|
|
<rule_exclude>0125-symantec-ws_rules.xml</rule_exclude>
|
|
<rule_exclude>0395-hp_rules.xml</rule_exclude>
|
|
<rule_exclude>0405-rsa-auth-manager_rules.xml</rule_exclude>
|
|
<rule_exclude>0410-imperva_rules.xml</rule_exclude>
|
|
<rule_exclude>0415-sophos_rules.xml</rule_exclude>
|
|
<rule_exclude>0990-amazon-security-lake_rules.xml</rule_exclude>
|
|
<rule_exclude>0435-ms_logs_rules.xml</rule_exclude>
|
|
<rule_exclude>0445-identity_guard_rules.xml</rule_exclude>
|
|
<rule_exclude>0450-mongodb_rules.xml</rule_exclude>
|
|
<rule_exclude>0460-jenkins_rules.xml</rule_exclude>
|
|
<rule_exclude>0470-vshell_rules.xml</rule_exclude>
|
|
<rule_exclude>0475-suricata_rules.xml</rule_exclude>
|
|
<rule_exclude>0480-qualysguard_rules.xml</rule_exclude>
|
|
<rule_exclude>0485-cylance_rules.xml</rule_exclude>
|
|
<rule_exclude>0700-paloalto_rules.xml</rule_exclude>
|
|
<rule_exclude>0500-owncloud_rules.xml</rule_exclude>
|
|
<rule_exclude>0505-vuls_rules.xml</rule_exclude>
|
|
<rule_exclude>0525-openvas_rules.xml</rule_exclude>
|
|
<rule_exclude>0530-mysql_audit_rules.xml</rule_exclude>
|
|
<rule_exclude>0535-mariadb_rules.xml</rule_exclude>
|
|
<rule_exclude>0540-pfsense_rules.xml</rule_exclude>
|
|
<rule_exclude>0545-osquery_rules.xml</rule_exclude>
|
|
<rule_exclude>0550-kaspersky_rules.xml</rule_exclude>
|
|
<rule_exclude>0555-azure_rules.xml</rule_exclude>
|
|
<rule_exclude>0565-ms_ipsec_rules.xml</rule_exclude>
|
|
<rule_exclude>0575-win-base_rules.xml</rule_exclude>
|
|
<rule_exclude>0580-win-security_rules.xml</rule_exclude>
|
|
<rule_exclude>0585-win-application_rules.xml</rule_exclude>
|
|
<rule_exclude>0590-win-system_rules.xml</rule_exclude>
|
|
<rule_exclude>0601-win-vipre_rules.xml</rule_exclude>
|
|
<rule_exclude>0602-win-wfirewall_rules.xml</rule_exclude>
|
|
<rule_exclude>0610-win-ms_logs_rules.xml</rule_exclude>
|
|
<rule_exclude>0630-nextcloud_rules.xml</rule_exclude>
|
|
<rule_exclude>0675-panda-paps_rules.xml</rule_exclude>
|
|
<rule_exclude>0680-checkpoint-smart1_rules.xml</rule_exclude>
|
|
<rule_exclude>0770-gitlab_rules.xml</rule_exclude>
|
|
<rule_exclude>0775-arbor_rules.xml</rule_exclude>
|
|
<rule_exclude>0780-fireeye_rules.xml</rule_exclude>
|
|
<rule_exclude>0785-huawei-usg_rules.xml</rule_exclude>
|
|
<rule_exclude>0800-sysmon_id_1.xml</rule_exclude>
|
|
<rule_exclude>0810-sysmon_id_3.xml</rule_exclude>
|
|
<rule_exclude>0820-sysmon_id_7.xml</rule_exclude>
|
|
<rule_exclude>0830-sysmon_id_11.xml</rule_exclude>
|
|
<rule_exclude>0840-win_event_channel.xml</rule_exclude>
|
|
<rule_exclude>0860-sysmon_id_13.xml</rule_exclude>
|
|
<rule_exclude>0870-sysmon_id_8.xml</rule_exclude>
|
|
<rule_exclude>0905-cisco-ftd_rules.xml</rule_exclude>
|
|
<rule_exclude>0690-gcp_rules.xml</rule_exclude>
|
|
<rule_exclude>0910-ms-exchange-proxylogon_rules.xml</rule_exclude>
|
|
<rule_exclude>0920-oracledb_rules.xml</rule_exclude>
|
|
<rule_exclude>0925-eset-remote_rules.xml</rule_exclude>
|
|
<rule_exclude>0955-WEF-baseline_rules.xml</rule_exclude>
|
|
<rule_exclude>0960-macos_rules.xml</rule_exclude>
|
|
<rule_exclude>0995-microsoft-graph_rules.xml</rule_exclude>
|
|
<rule_exclude>0755-office365_rules.xml</rule_exclude>
|
|
<rule_exclude>0140-roundcube_rules.xml</rule_exclude>
|
|
<rule_exclude>0998-aws-security-hub-rules.xml</rule_exclude>
|
|
<rule_exclude>0400-openvpn_rules.xml</rule_exclude>
|
|
<list>etc/lists/audit-keys</list>
|
|
<list>etc/lists/amazon/aws-eventnames</list>
|
|
<list>etc/lists/security-eventchannel</list>
|
|
<list>etc/lists/malicious-ioc/malicious-ip</list>
|
|
<list>etc/lists/malicious-ioc/malicious-domains</list>
|
|
<list>etc/lists/malicious-ioc/malware-hashes</list>
|
|
<list>etc/lists/wireguard-trusted-ips</list>
|
|
<!-- Decoders et règles custom ModSecurity -->
|
|
<decoder_dir>etc/decoders</decoder_dir>
|
|
<rule_dir>etc/rules</rule_dir>
|
|
</ruleset>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
RULE TEST
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<rule_test>
|
|
<enabled>yes</enabled>
|
|
<threads>1</threads>
|
|
<max_sessions>64</max_sessions>
|
|
<session_timeout>15m</session_timeout>
|
|
</rule_test>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
AUTHENTIFICATION AGENTS (wazuh-authd)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<auth>
|
|
<disabled>no</disabled>
|
|
<port>1515</port>
|
|
<use_source_ip>no</use_source_ip>
|
|
<purge>yes</purge>
|
|
<use_password>no</use_password>
|
|
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
|
<ssl_verify_host>no</ssl_verify_host>
|
|
<ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
|
|
<ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
|
|
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
|
</auth>
|
|
|
|
<!-- ═══════════════════════════════════════════════════════════
|
|
CLUSTER (standalone — désactivé)
|
|
═══════════════════════════════════════════════════════════ -->
|
|
<cluster>
|
|
<name>wazuh</name>
|
|
<node_name>node01</node_name>
|
|
<node_type>master</node_type>
|
|
<key>aa093264ef885029653eea20dfcf51ae</key>
|
|
<port>1516</port>
|
|
<bind_addr>0.0.0.0</bind_addr>
|
|
<nodes>
|
|
<node>wazuh.manager</node>
|
|
</nodes>
|
|
<hidden>no</hidden>
|
|
<disabled>yes</disabled>
|
|
</cluster>
|
|
|
|
</ossec_config>
|
|
|
|
<ossec_config>
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/ossec/logs/active-responses.log</location>
|
|
</localfile>
|
|
</ossec_config>
|