Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: delete monitoring

Browse Source
This commit is contained in:
Xor290
2026-06-10 13:59:46 +02:00
parent 27558d7651
commit 0835c06d8b
24 changed files with 0 additions and 2062 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/crowdsec/acquis.yaml
-22
View File
@@ -1,22 +0,0 @@
# Logs nginx depuis le container Docker
source: docker
container_name:
- monitoring_nginx
labels:
type: nginx
---
# Logs SSH du VPS hôte
source: file
filenames:
- /var/log/auth.log
labels:
type: syslog
---
# Logs système du VPS hôte
source: file
filenames:
- /var/log/syslog
labels:
type: syslog
monitoring/docker-compose.yml
-219
View File
@@ -1,219 +0,0 @@
services:
# ─── Dozzle ───────────────────────────────────────────────
dozzle:
image: amir20/dozzle:latest
container_name: dozzle
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./dozzle/users.yml:/data/users.yml:ro
environment:
DOZZLE_AUTH_PROVIDER: simple
DOZZLE_AUTH_TTL: 48h
DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS"
networks:
- monitoring_net
# ─── Nginx ────────────────────────────────────────────────
nginx:
image: nginx:alpine
container_name: monitoring_nginx
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- dozzle
- wazuh.dashboard
networks:
- monitoring_net
# ─── Wazuh Manager ────────────────────────────────────────
wazuh.manager:
image: wazuh/wazuh-manager:4.14.5
hostname: wazuh.manager
container_name: wazuh_manager
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
ports:
- "1514:1514" # Communication agents
- "1515:1515" # Enrôlement agents
- "514:514/udp" # Syslog entrant
environment:
- INDEXER_URL=https://wazuh.indexer:9200
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- FILEBEAT_SSL_VERIFICATION_MODE=full
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
- SSL_KEY=/etc/ssl/filebeat.key
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
entrypoint: ["/bin/bash", "/wazuh-custom/init.sh"]
volumes:
- ./wazuh/config/wazuh_manager/:/wazuh-custom/:ro
- wazuh_api_configuration:/var/ossec/api/configuration
- wazuh_etc:/var/ossec/etc
- wazuh_logs:/var/ossec/logs
- wazuh_queue:/var/ossec/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_integrations:/var/ossec/integrations
- wazuh_active_response:/var/ossec/active-response/bin
- wazuh_agentless:/var/ossec/agentless
- wazuh_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
networks:
- monitoring_net
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
wazuh.indexer:
image: wazuh/wazuh-indexer:4.14.5
hostname: wazuh.indexer
container_name: wazuh_indexer
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
environment:
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
volumes:
- wazuh_indexer_data:/var/lib/wazuh-indexer
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
- ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
- ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
networks:
- monitoring_net
# ─── Wazuh Dashboard ──────────────────────────────────────
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.5
hostname: wazuh.dashboard
container_name: wazuh_dashboard
restart: unless-stopped
environment:
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
volumes:
- ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
depends_on:
- wazuh.indexer
- wazuh.manager
networks:
- monitoring_net
rustfs_perm:
image: alpine:latest
container_name: rustfs_perm
volumes:
- /mnt/data:/data
command: chown -R 1000:1000 /data
rustfs:
image: rustfs/rustfs:latest
depends_on:
rustfs_perm:
condition: service_completed_successfully
hostname: rustfs
container_name: rustfs
restart: unless-stopped
volumes:
- /mnt/data:/data
environment:
- RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin}
- RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin}
- RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
- RUSTFS_CONSOLE_ENABLE=true
- RUSTFS_ADDRESS=:9000
- RUSTFS_CONSOLE_ADDRESS=:9001
networks:
- monitoring_net
# ─── Xavia OTA — PostgreSQL ───────────────────────────────
xavia_db:
image: postgres:16-alpine
container_name: xavia_db
restart: unless-stopped
environment:
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
volumes:
- xavia_db_data:/var/lib/postgresql/data
networks:
- monitoring_net
# ─── Xavia OTA ────────────────────────────────────────────
xavia:
image: xaviaio/xavia-ota:latest
container_name: xavia
restart: unless-stopped
environment:
- HOST=https://ota.uber-stup.club
- BLOB_STORAGE_TYPE=local
- DB_TYPE=postgres
- ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
- UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
- PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
- POSTGRES_HOST=xavia_db
- POSTGRES_PORT=5432
volumes:
- xavia_blobs:/app/blobs
depends_on:
- xavia_db
networks:
- monitoring_net
networks:
monitoring_net:
driver: bridge
volumes:
# Xavia
xavia_db_data:
xavia_blobs:
# Wazuh
wazuh_api_configuration:
wazuh_etc:
wazuh_logs:
wazuh_queue:
wazuh_var_multigroups:
wazuh_integrations:
wazuh_active_response:
wazuh_agentless:
wazuh_wodles:
filebeat_etc:
filebeat_var:
wazuh_indexer_data:
nginx_logs:
monitoring/dozzle/users.yml
-6
View File
@@ -1,6 +0,0 @@
users:
admin:
name: Admin
email: admin@uber-stup.club
password: $2b$11$AOUC5QG2l8Ee0gUKIyZGKuHdL0iuvDa3C0bVAl2Gyt6Axx7.E/hHm
roles: download
monitoring/nginx/nginx.conf
-155
View File
@@ -1,155 +0,0 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
# Redirect HTTP -> HTTPS
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
# ── Dozzle ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name dozzle.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/dozzle_access.log;
error_log /var/log/nginx/dozzle_error.log;
location / {
proxy_pass http://dozzle:8080;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── RustFS Console ──────────────────────────────────────
server {
listen 443 ssl;
server_name rustfs.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_access.log;
error_log /var/log/nginx/rustfs_error.log;
# Console web (port 9001)
location / {
proxy_pass http://rustfs:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── RustFS S3 API ───────────────────────────────────────
server {
listen 443 ssl;
server_name s3.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_s3_access.log;
error_log /var/log/nginx/rustfs_s3_error.log;
location / {
proxy_pass http://rustfs:9000;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
client_max_body_size 2g;
}
}
# ── Xavia OTA ───────────────────────────────────────────
server {
listen 443 ssl;
server_name ota.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/xavia_access.log;
error_log /var/log/nginx/xavia_error.log;
location / {
proxy_pass http://xavia:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── Wazuh Dashboard ─────────────────────────────────────
server {
listen 443 ssl;
server_name wazuh.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
proxy_pass https://wazuh.dashboard:5601;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;
}
}
}
monitoring/s3/.env
-9
View File
@@ -1,9 +0,0 @@
RUSTFS_ACCESS_KEY=iBacJPHUHSf6SMTnxrr
RUSTFS_SECRET_KEY=4jNzZhstv1WkwTwtvR4gHSbrx01m4sJl4LBBleeJ
XAVIA_ADMIN_PASSWORD=2VYfheOweyMiP510GGfjNYmq3vJGJ
XAVIA_UPLOAD_KEY=dNW2tiNXRR6w1cLwlmCOyKFIKvoTz8xQMSyd
XAVIA_PRIVATE_KEY_BASE_64=MlRvcGlyNHpFRjhYOTlvUjMxbHFCVHRQdjYyelh4Wnc0MDM4TkZaVQ==
XAVIA_POSTGRES_USER=xavia
XAVIA_POSTGRES_PASSWORD=6DzLcsb5rgWukuGdrHtRBQ222f
XAVIA_POSTGRES_DB=releases_db
monitoring/s3/docker-compose-s3.yml
-99
View File
@@ -1,99 +0,0 @@
services:
nginx:
image: nginx:alpine
container_name: s3_nginx
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- rustfs
- xavia
networks:
- s3_net
rustfs_perm:
image: alpine:latest
container_name: rustfs_perm
volumes:
- /mnt/data:/data
command: chown -R 10001:10001 /data
rustfs:
image: rustfs/rustfs:latest
depends_on:
rustfs_perm:
condition: service_completed_successfully
hostname: rustfs
container_name: rustfs
restart: unless-stopped
volumes:
- /mnt/data:/data
- /mnt/logs:/logs
environment:
- RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-iBacJPHUHSf6SMTnxrr}
- RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-4jNzZhstv1WkwTwtvR4gHSbrx01m4sJl4LBBleeJ}
- RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
- RUSTFS_CONSOLE_ENABLE=true
- RUSTFS_ADDRESS=:9000
- RUSTFS_CONSOLE_ADDRESS=:9001
networks:
- s3_net
xavia_db:
image: postgres:16-alpine
container_name: xavia_db
restart: unless-stopped
environment:
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
volumes:
- xavia_db_data:/var/lib/postgresql/data
networks:
- s3_net
xavia:
image: xaviaio/xavia-ota:latest
container_name: xavia
restart: unless-stopped
environment:
- HOST=https://ota.uber-stup.club
- BLOB_STORAGE_TYPE=local
- DB_TYPE=postgres
- ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
- UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
- PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
- POSTGRES_HOST=xavia_db
- POSTGRES_PORT=5432
volumes:
- xavia_blobs:/app/blobs
depends_on:
- xavia_db
networks:
- s3_net
dozzle-agent:
image: amir20/dozzle:latest
command: agent
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "7007:7007"
restart: unless-stopped
networks:
s3_net:
driver: bridge
volumes:
nginx_logs:
xavia_db_data:
xavia_blobs:
monitoring/s3/nginx/nginx.conf
-98
View File
@@ -1,98 +0,0 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# Redirect HTTP -> HTTPS
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
# ── RustFS Console ──────────────────────────────────────
server {
listen 443 ssl;
server_name rustfs.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_access.log;
error_log /var/log/nginx/rustfs_error.log;
location / {
set $upstream http://rustfs:9001;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── RustFS S3 API ───────────────────────────────────────
server {
listen 443 ssl;
server_name s3.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_s3_access.log;
error_log /var/log/nginx/rustfs_s3_error.log;
location / {
set $upstream http://rustfs:9000;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
client_max_body_size 2g;
}
}
# ── Xavia OTA ───────────────────────────────────────────
server {
listen 443 ssl;
server_name ota.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/xavia_access.log;
error_log /var/log/nginx/xavia_error.log;
location / {
set $upstream http://xavia:3000;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
}
monitoring/security/.env
-8
View File
@@ -1,8 +0,0 @@
# Dozzle
DOZZLE_USERNAME=admin_mln_monitoring
DOZZLE_PASSWORD=dX753n05Jo4T6B66cR
# Wazuh — changer TOUS ces mots de passe avant de déployer
WAZUH_INDEXER_PASSWORD=9qB523OjLyFSp6vMpH!
WAZUH_API_PASSWORD=myAJYqnemF544nsD33!
WAZUH_DASHBOARD_PASSWORD=E9Jpr6586kQ3wYrCS2!
monitoring/security/docker-compose-security.yml
-160
View File
@@ -1,160 +0,0 @@
services:
dozzle:
image: amir20/dozzle:latest
container_name: dozzle
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./dozzle/users.yml:/data/users.yml:ro
environment:
DOZZLE_AUTH_PROVIDER: simple
DOZZLE_AUTH_TTL: 48h
DOZZLE_REMOTE_AGENT: "185.103.166.112:7007|pre-prod-uber|VPS,185.103.166.119:7007|prod-uber|VPS"
networks:
- monitoring_net
nginx:
image: nginx:alpine
container_name: monitoring_nginx
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- dozzle
- wazuh.dashboard
- beszel
networks:
- monitoring_net
# ─── Beszel Hub ───────────────────────────────────────────
beszel:
image: henrygd/beszel:latest
container_name: beszel
restart: unless-stopped
volumes:
- beszel_data:/beszel_data
networks:
- monitoring_net
wazuh.manager:
image: wazuh/wazuh-manager:4.14.5
hostname: wazuh.manager
container_name: wazuh_manager
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
ports:
- "1514:1514" # Communication agents
- "1515:1515" # Enrôlement agents
- "514:514/udp" # Syslog entrant
environment:
- INDEXER_URL=https://wazuh.indexer:9200
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- FILEBEAT_SSL_VERIFICATION_MODE=full
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
- SSL_KEY=/etc/ssl/filebeat.key
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
entrypoint: ["/bin/bash", "/wazuh-custom/init.sh"]
volumes:
- ./wazuh/config/wazuh_manager/:/wazuh-custom/:ro
- wazuh_api_configuration:/var/ossec/api/configuration
- wazuh_etc:/var/ossec/etc
- wazuh_logs:/var/ossec/logs
- wazuh_queue:/var/ossec/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_integrations:/var/ossec/integrations
- wazuh_active_response:/var/ossec/active-response/bin
- wazuh_agentless:/var/ossec/agentless
- wazuh_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
networks:
- monitoring_net
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
wazuh.indexer:
image: wazuh/wazuh-indexer:4.14.5
hostname: wazuh.indexer
container_name: wazuh_indexer
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
environment:
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
volumes:
- wazuh_indexer_data:/var/lib/wazuh-indexer
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
- ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
- ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
networks:
- monitoring_net
# ─── Wazuh Dashboard ──────────────────────────────────────
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.5
hostname: wazuh.dashboard
container_name: wazuh_dashboard
restart: unless-stopped
environment:
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
volumes:
- ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
depends_on:
- wazuh.indexer
- wazuh.manager
networks:
- monitoring_net
networks:
monitoring_net:
driver: bridge
volumes:
wazuh_api_configuration:
wazuh_etc:
wazuh_logs:
wazuh_queue:
wazuh_var_multigroups:
wazuh_integrations:
wazuh_active_response:
wazuh_agentless:
wazuh_wodles:
filebeat_etc:
filebeat_var:
wazuh_indexer_data:
nginx_logs:
beszel_data:
monitoring/security/dozzle/users.yml
-6
View File
@@ -1,6 +0,0 @@
users:
admin:
name: Admin
email: admin@uber-stup.club
password: $2b$11$AOUC5QG2l8Ee0gUKIyZGKuHdL0iuvDa3C0bVAl2Gyt6Axx7.E/hHm
roles: download
monitoring/security/nginx/nginx.conf
-108
View File
@@ -1,108 +0,0 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# Redirect HTTP -> HTTPS
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
# ── Dozzle ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name dozzle.demo-uber.xyz;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/dozzle_access.log;
error_log /var/log/nginx/dozzle_error.log;
location / {
set $upstream http://dozzle:8080;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── Wazuh Dashboard ─────────────────────────────────────
server {
listen 443 ssl;
server_name wazuh.demo-uber.xyz;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
set $upstream https://wazuh.dashboard:5601;
proxy_pass $upstream;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;
}
}
# ── Beszel ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name beszel.demo-uber.xyz;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/beszel_access.log;
error_log /var/log/nginx/beszel_error.log;
location / {
set $upstream http://beszel:8090;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
}
monitoring/security/wazuh/config/certs.yml
-10
View File
@@ -1,10 +0,0 @@
nodes:
indexer:
- name: wazuh.indexer
ip: "wazuh.indexer"
server:
- name: wazuh.manager
ip: "wazuh.manager"
dashboard:
- name: wazuh.dashboard
ip: "wazuh.dashboard"
monitoring/security/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
-12
View File
@@ -1,12 +0,0 @@
server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: https://wazuh.indexer:9200
opensearch.ssl.verificationMode: certificate
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true
server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
uiSettings.overrides.defaultRoute: /app/wz-home
monitoring/security/wazuh/config/wazuh_indexer/internal_users.yml
-45
View File
@@ -1,45 +0,0 @@
---
_meta:
type: "internalusers"
config_version: 2
admin:
hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
reserved: true
backend_roles:
- "admin"
description: "Admin user"
kibanaserver:
hash: "$2b$12$czi/zi7uht/K5.vcCvsXueFi6ot7GFwFfVBax7rCaNqBq1jhTOZ7u"
reserved: true
description: "Kibanaserver user"
kibanaro:
hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
reserved: false
backend_roles:
- "kibanauser"
- "readall"
description: "Kibana read-only user"
logstash:
hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
reserved: false
backend_roles:
- "logstash"
description: "Logstash user"
readall:
hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
reserved: false
backend_roles:
- "readall"
description: "Readall user"
snapshotrestore:
hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
reserved: false
backend_roles:
- "snapshotrestore"
description: "Snapshotrestore user"
monitoring/security/wazuh/config/wazuh_indexer/wazuh.indexer.yml
-51
View File
@@ -1,51 +0,0 @@
network.host: "0.0.0.0"
node.name: "wazuh.indexer"
cluster.name: "wazuh-cluster"
# Compatibilité Filebeat 7.x (libbeat) avec OpenSearch 2.x
# Filebeat envoie _type dans les requêtes bulk — OpenSearch 2.x le rejette
# sans ce flag.
compatibility.override_main_response_version: true
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.authcz.admin_dn:
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.nodes_dn:
- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices:
- ".opendistro-alerting-config"
- ".opendistro-alerting-alert*"
- ".opendistro-anomaly-results*"
- ".opendistro-anomaly-detector*"
- ".opendistro-anomaly-checkpoints"
- ".opendistro-anomaly-detection-state"
- ".opendistro-reports-*"
- ".opendistro-notifications-*"
- ".opendistro-notebooks"
- ".opensearch-observability"
- ".opendistro-asynchronous-search-response*"
- ".replication-metadata-store"
discovery.type: single-node
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
monitoring/security/wazuh/config/wazuh_manager/decoders/modsecurity_decoder.xml
-4
View File
@@ -1,4 +0,0 @@
<!-- ModSecurity decoder — non utilisé, remplacé par règles json+location -->
<decoder name="waf-modsec-unused">
<prematch>UNUSED_MODSEC_PLACEHOLDER_NEVER_MATCHES</prematch>
</decoder>
monitoring/security/wazuh/config/wazuh_manager/init.sh
-14
View File
@@ -1,14 +0,0 @@
#!/bin/bash
set -e
# ─── Copie de la config custom (montée hors du volume wazuh_etc) ──────────────
CUSTOM=/wazuh-custom
cp "$CUSTOM/ossec.conf" /var/ossec/etc/ossec.conf
mkdir -p /var/ossec/etc/decoders /var/ossec/etc/rules
cp "$CUSTOM/decoders/"*.xml /var/ossec/etc/decoders/ 2>/dev/null || true
cp "$CUSTOM/rules/"*.xml /var/ossec/etc/rules/ 2>/dev/null || true
# ─── Démarrage Wazuh Manager (entrypoint original) ────────────────────────────
exec /init
monitoring/security/wazuh/config/wazuh_manager/ossec.conf
-638
View File
@@ -1,638 +0,0 @@
<ossec_config>
<!-- ═══════════════════════════════════════════════════════════
GLOBAL
═══════════════════════════════════════════════════════════ -->
<global>
<jsonout_output>yes</jsonout_output>
<alerts_log>yes</alerts_log>
<logall>no</logall>
<logall_json>no</logall_json>
<email_notification>no</email_notification>
<agents_disconnection_time>10m</agents_disconnection_time>
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
</global>
<!-- ═══════════════════════════════════════════════════════════
ALERTES
═══════════════════════════════════════════════════════════ -->
<alerts>
<log_alert_level>3</log_alert_level>
</alerts>
<!-- ═══════════════════════════════════════════════════════════
LOGGING
═══════════════════════════════════════════════════════════ -->
<logging>
<log_format>plain</log_format>
</logging>
<!-- ═══════════════════════════════════════════════════════════
COMMUNICATION AGENTS (port 1514 TCP)
═══════════════════════════════════════════════════════════ -->
<remote>
<connection>secure</connection>
<port>1514</port>
<protocol>tcp</protocol>
<queue_size>131072</queue_size>
</remote>
<!-- ═══════════════════════════════════════════════════════════
POLICY MONITORING
═══════════════════════════════════════════════════════════ -->
<rootcheck>
<disabled>no</disabled>
<check_files>yes</check_files>
<check_trojans>yes</check_trojans>
<check_dev>yes</check_dev>
<check_sys>yes</check_sys>
<check_pids>yes</check_pids>
<check_ports>yes</check_ports>
<check_if>yes</check_if>
<frequency>43200</frequency>
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
<skip_nfs>yes</skip_nfs>
</rootcheck>
<wodle name="cis-cat">
<disabled>yes</disabled>
<timeout>1800</timeout>
<interval>1d</interval>
<scan-on-start>yes</scan-on-start>
<java_path>wodles/java</java_path>
<ciscat_path>wodles/ciscat</ciscat_path>
</wodle>
<wodle name="osquery">
<disabled>yes</disabled>
<run_daemon>yes</run_daemon>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<add_labels>yes</add_labels>
</wodle>
<!-- ═══════════════════════════════════════════════════════════
SYSTEM INVENTORY
═══════════════════════════════════════════════════════════ -->
<wodle name="syscollector">
<disabled>no</disabled>
<interval>1h</interval>
<scan_on_start>yes</scan_on_start>
<hardware>yes</hardware>
<os>yes</os>
<network>yes</network>
<packages>yes</packages>
<ports all="yes">yes</ports>
<processes>yes</processes>
<synchronization>
<max_eps>10</max_eps>
</synchronization>
</wodle>
<!-- ═══════════════════════════════════════════════════════════
SECURITY CONFIGURATION ASSESSMENT
═══════════════════════════════════════════════════════════ -->
<sca>
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
</sca>
<!-- ═══════════════════════════════════════════════════════════
VULNERABILITY DETECTION
═══════════════════════════════════════════════════════════ -->
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>
<!-- ═══════════════════════════════════════════════════════════
INDEXER (Wazuh Indexer / OpenSearch)
═══════════════════════════════════════════════════════════ -->
<indexer>
<enabled>yes</enabled>
<hosts>
<host>https://wazuh.indexer:9200</host>
</hosts>
<ssl>
<certificate_authorities>
<ca>/etc/ssl/root-ca.pem</ca>
</certificate_authorities>
<certificate>/etc/ssl/filebeat.pem</certificate>
<key>/etc/ssl/filebeat.key</key>
</ssl>
</indexer>
<!-- ═══════════════════════════════════════════════════════════
FILE INTEGRITY MONITORING
═══════════════════════════════════════════════════════════ -->
<syscheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<alert_new_files>yes</alert_new_files>
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
<directories>/etc,/usr/bin,/usr/sbin</directories>
<directories>/bin,/sbin,/boot</directories>
<ignore>/etc/mtab</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/random.seed</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/utmpx</ignore>
<ignore>/etc/wtmpx</ignore>
<ignore>/etc/cups/certs</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/etc/svc/volatile</ignore>
<ignore type="sregex">.log$|.swp$</ignore>
<nodiff>/etc/ssl/private.key</nodiff>
<skip_nfs>yes</skip_nfs>
<skip_dev>yes</skip_dev>
<skip_proc>yes</skip_proc>
<skip_sys>yes</skip_sys>
<process_priority>10</process_priority>
<max_eps>100</max_eps>
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_interval>1h</max_interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
<!-- ═══════════════════════════════════════════════════════════
ACTIVE RESPONSE — WHITELIST
90.50.148.138 : IP publique admin — jamais bloquée
═══════════════════════════════════════════════════════════ -->
<global>
<white_list>127.0.0.1</white_list>
<white_list>^localhost.localdomain$</white_list>
<white_list>90.50.148.138</white_list>
</global>
<!-- ═══════════════════════════════════════════════════════════
ACTIVE RESPONSE — COMMANDES
═══════════════════════════════════════════════════════════ -->
<command>
<name>disable-account</name>
<executable>disable-account</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>restart-wazuh</name>
<executable>restart-wazuh</executable>
</command>
<command>
<name>firewall-drop</name>
<executable>firewall-drop</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>host-deny</name>
<executable>host-deny</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>route-null</name>
<executable>route-null</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>win_route-null</name>
<executable>route-null.exe</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>netsh</name>
<executable>netsh.exe</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<command>
<name>clamav-quarantine</name>
<executable>clamav-quarantine</executable>
<timeout_allowed>no</timeout_allowed>
</command>
<!-- ═══════════════════════════════════════════════════════════
ACTIVE RESPONSE — RÈGLES
═══════════════════════════════════════════════════════════ -->
<!-- SSH mauvais mot de passe → ban PERMANENT (1 tentative suffit) -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
<timeout>0</timeout>
</active-response>
<!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_group>authentication_failures</rules_group>
<timeout>0</timeout>
</active-response>
<!-- Échec auth générique → ban PERMANENT -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_group>authentication_failed</rules_group>
<timeout>0</timeout>
</active-response>
<!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
<active-response>
<command>host-deny</command>
<location>local</location>
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
<timeout>0</timeout>
</active-response>
<!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<level>7</level>
<rules_group>web,attack</rules_group>
<timeout>300</timeout>
</active-response>
<!-- Scan de ports → firewall-drop 1 heure -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>1002,2502,2503,2504</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- SSH brute-force → host-deny PERMANENT (double protection) -->
<active-response>
<command>host-deny</command>
<location>local</location>
<rules_group>authentication_failures,authentication_failed</rules_group>
<timeout>0</timeout>
</active-response>
<!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100202,100203,100205</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- ModSecurity RCE / anomalie critique → firewall-drop 24 heures -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100204,100206</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- ClamAV virus détecté → quarantaine du fichier infecté -->
<active-response>
<command>clamav-quarantine</command>
<location>local</location>
<rules_id>52502</rules_id>
</active-response>
<!-- Attaque soutenue ModSec (5 blocs / 2 min) → firewall-drop 24 heures -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100210</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- SSH brute-force (3 tentatives / 60s) → firewall-drop 1 heure -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100300</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- SSH scan de comptes (3 users inexistants / 60s) → firewall-drop 24 heures -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100301</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- Sudo brute-force (3 échecs / 5 min) → disable-account 2h + firewall-drop 6h -->
<active-response>
<command>disable-account</command>
<location>local</location>
<rules_id>100310</rules_id>
<timeout>7200</timeout>
</active-response>
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100310</rules_id>
<timeout>21600</timeout>
</active-response>
<active-response>
<disabled>no</disabled>
<command>host-deny</command>
<location>all</location>
<rules_id>100210</rules_id>
<timeout>86400</timeout>
</active-response>
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100204,100206</rules_id>
<timeout>86400</timeout>
</active-response>
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
<timeout>0</timeout>
</active-response>
<!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_group>authentication_failures</rules_group>
<timeout>0</timeout>
</active-response>
<!-- Échec auth générique → ban PERMANENT -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_group>authentication_failed</rules_group>
<timeout>0</timeout>
</active-response>
<!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
<active-response>
<command>host-deny</command>
<location>all</location>
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
<timeout>0</timeout>
</active-response>
<!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<level>7</level>
<rules_group>web,attack</rules_group>
<timeout>300</timeout>
</active-response>
<!-- Scan de ports → firewall-drop 1 heure -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>1002,2502,2503,2504</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- SSH brute-force → host-deny PERMANENT (double protection) -->
<active-response>
<command>host-deny</command>
<location>all</location>
<rules_group>authentication_failures,authentication_failed</rules_group>
<timeout>0</timeout>
</active-response>
<!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100202,100203,100205</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- SSH brute-force (3 tentatives / 60s) → firewall-drop 1 heure sur tous les agents -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100300</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- SSH scan de comptes → firewall-drop 24 heures sur tous les agents -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100301</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- ═══════════════════════════════════════════════════════════
LOG ANALYSIS (commandes système)
═══════════════════════════════════════════════════════════ -->
<localfile>
<log_format>command</log_format>
<command>df -P</command>
<frequency>360</frequency>
</localfile>
<localfile>
<log_format>full_command</log_format>
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
<alias>netstat listening ports</alias>
<frequency>360</frequency>
</localfile>
<localfile>
<log_format>full_command</log_format>
<command>last -n 20</command>
<frequency>360</frequency>
</localfile>
<!-- ═══════════════════════════════════════════════════════════
RULESET
═══════════════════════════════════════════════════════════ -->
<ruleset>
<!-- Règles et decoders natifs Wazuh -->
<decoder_dir>ruleset/decoders</decoder_dir>
<rule_dir>ruleset/rules</rule_dir>
<!-- Règles exclues — non pertinentes pour ce stack -->
<rule_exclude>0025-sendmail_rules.xml</rule_exclude>
<rule_exclude>0030-postfix_rules.xml</rule_exclude>
<rule_exclude>0035-spamd_rules.xml</rule_exclude>
<rule_exclude>0040-imapd_rules.xml</rule_exclude>
<rule_exclude>0045-mailscanner_rules.xml</rule_exclude>
<rule_exclude>0050-ms-exchange_rules.xml</rule_exclude>
<rule_exclude>0055-courier_rules.xml</rule_exclude>
<rule_exclude>0065-pix_rules.xml</rule_exclude>
<rule_exclude>0070-netscreenfw_rules.xml</rule_exclude>
<rule_exclude>0075-cisco-ios_rules.xml</rule_exclude>
<rule_exclude>0080-sonicwall_rules.xml</rule_exclude>
<rule_exclude>0090-telnetd_rules.xml</rule_exclude>
<rule_exclude>0100-solaris_bsm_rules.xml</rule_exclude>
<rule_exclude>0105-asterisk_rules.xml</rule_exclude>
<rule_exclude>0110-ms_dhcp_rules.xml</rule_exclude>
<rule_exclude>0115-arpwatch_rules.xml</rule_exclude>
<rule_exclude>0130-trend-osce_rules.xml</rule_exclude>
<rule_exclude>0135-hordeimp_rules.xml</rule_exclude>
<rule_exclude>0155-dovecot_rules.xml</rule_exclude>
<rule_exclude>0160-vmpop3d_rules.xml</rule_exclude>
<rule_exclude>0165-vpopmail_rules.xml</rule_exclude>
<rule_exclude>0170-ftpd_rules.xml</rule_exclude>
<rule_exclude>0175-proftpd_rules.xml</rule_exclude>
<rule_exclude>0185-vsftpd_rules.xml</rule_exclude>
<rule_exclude>0190-ms_ftpd_rules.xml</rule_exclude>
<rule_exclude>0195-named_rules.xml</rule_exclude>
<rule_exclude>0215-policy_rules.xml</rule_exclude>
<rule_exclude>0750-github_rules.xml</rule_exclude>
<rule_exclude>0250-apache_rules.xml</rule_exclude>
<rule_exclude>0255-zeus_rules.xml</rule_exclude>
<rule_exclude>0265-php_rules.xml</rule_exclude>
<rule_exclude>0275-squid_rules.xml</rule_exclude>
<rule_exclude>0295-mysql_rules.xml</rule_exclude>
<rule_exclude>0305-dropbear_rules.xml</rule_exclude>
<rule_exclude>0315-apparmor_rules.xml</rule_exclude>
<rule_exclude>0350-amazon_rules.xml</rule_exclude>
<rule_exclude>0360-serv-u_rules.xml</rule_exclude>
<rule_exclude>0385-oscap_rules.xml</rule_exclude>
<rule_exclude>0390-fortiddos_rules.xml</rule_exclude>
<rule_exclude>0391-fortigate_rules.xml</rule_exclude>
<rule_exclude>0392-fortimail_rules.xml</rule_exclude>
<rule_exclude>0393-fortiauth_rules.xml</rule_exclude>
<rule_exclude>0120-symantec-av_rules.xml</rule_exclude>
<rule_exclude>0125-symantec-ws_rules.xml</rule_exclude>
<rule_exclude>0395-hp_rules.xml</rule_exclude>
<rule_exclude>0405-rsa-auth-manager_rules.xml</rule_exclude>
<rule_exclude>0410-imperva_rules.xml</rule_exclude>
<rule_exclude>0415-sophos_rules.xml</rule_exclude>
<rule_exclude>0990-amazon-security-lake_rules.xml</rule_exclude>
<rule_exclude>0435-ms_logs_rules.xml</rule_exclude>
<rule_exclude>0445-identity_guard_rules.xml</rule_exclude>
<rule_exclude>0450-mongodb_rules.xml</rule_exclude>
<rule_exclude>0460-jenkins_rules.xml</rule_exclude>
<rule_exclude>0470-vshell_rules.xml</rule_exclude>
<rule_exclude>0475-suricata_rules.xml</rule_exclude>
<rule_exclude>0480-qualysguard_rules.xml</rule_exclude>
<rule_exclude>0485-cylance_rules.xml</rule_exclude>
<rule_exclude>0700-paloalto_rules.xml</rule_exclude>
<rule_exclude>0500-owncloud_rules.xml</rule_exclude>
<rule_exclude>0505-vuls_rules.xml</rule_exclude>
<rule_exclude>0525-openvas_rules.xml</rule_exclude>
<rule_exclude>0530-mysql_audit_rules.xml</rule_exclude>
<rule_exclude>0535-mariadb_rules.xml</rule_exclude>
<rule_exclude>0540-pfsense_rules.xml</rule_exclude>
<rule_exclude>0545-osquery_rules.xml</rule_exclude>
<rule_exclude>0550-kaspersky_rules.xml</rule_exclude>
<rule_exclude>0555-azure_rules.xml</rule_exclude>
<rule_exclude>0565-ms_ipsec_rules.xml</rule_exclude>
<rule_exclude>0575-win-base_rules.xml</rule_exclude>
<rule_exclude>0580-win-security_rules.xml</rule_exclude>
<rule_exclude>0585-win-application_rules.xml</rule_exclude>
<rule_exclude>0590-win-system_rules.xml</rule_exclude>
<rule_exclude>0601-win-vipre_rules.xml</rule_exclude>
<rule_exclude>0602-win-wfirewall_rules.xml</rule_exclude>
<rule_exclude>0610-win-ms_logs_rules.xml</rule_exclude>
<rule_exclude>0630-nextcloud_rules.xml</rule_exclude>
<rule_exclude>0675-panda-paps_rules.xml</rule_exclude>
<rule_exclude>0680-checkpoint-smart1_rules.xml</rule_exclude>
<rule_exclude>0770-gitlab_rules.xml</rule_exclude>
<rule_exclude>0775-arbor_rules.xml</rule_exclude>
<rule_exclude>0780-fireeye_rules.xml</rule_exclude>
<rule_exclude>0785-huawei-usg_rules.xml</rule_exclude>
<rule_exclude>0800-sysmon_id_1.xml</rule_exclude>
<rule_exclude>0810-sysmon_id_3.xml</rule_exclude>
<rule_exclude>0820-sysmon_id_7.xml</rule_exclude>
<rule_exclude>0830-sysmon_id_11.xml</rule_exclude>
<rule_exclude>0840-win_event_channel.xml</rule_exclude>
<rule_exclude>0860-sysmon_id_13.xml</rule_exclude>
<rule_exclude>0870-sysmon_id_8.xml</rule_exclude>
<rule_exclude>0905-cisco-ftd_rules.xml</rule_exclude>
<rule_exclude>0690-gcp_rules.xml</rule_exclude>
<rule_exclude>0910-ms-exchange-proxylogon_rules.xml</rule_exclude>
<rule_exclude>0920-oracledb_rules.xml</rule_exclude>
<rule_exclude>0925-eset-remote_rules.xml</rule_exclude>
<rule_exclude>0955-WEF-baseline_rules.xml</rule_exclude>
<rule_exclude>0960-macos_rules.xml</rule_exclude>
<rule_exclude>0995-microsoft-graph_rules.xml</rule_exclude>
<rule_exclude>0755-office365_rules.xml</rule_exclude>
<rule_exclude>0140-roundcube_rules.xml</rule_exclude>
<rule_exclude>0998-aws-security-hub-rules.xml</rule_exclude>
<rule_exclude>0400-openvpn_rules.xml</rule_exclude>
<list>etc/lists/audit-keys</list>
<list>etc/lists/amazon/aws-eventnames</list>
<list>etc/lists/security-eventchannel</list>
<list>etc/lists/malicious-ioc/malicious-ip</list>
<list>etc/lists/malicious-ioc/malicious-domains</list>
<list>etc/lists/malicious-ioc/malware-hashes</list>
<!-- Decoders et règles custom ModSecurity -->
<decoder_dir>etc/decoders</decoder_dir>
<rule_dir>etc/rules</rule_dir>
</ruleset>
<!-- ═══════════════════════════════════════════════════════════
RULE TEST
═══════════════════════════════════════════════════════════ -->
<rule_test>
<enabled>yes</enabled>
<threads>1</threads>
<max_sessions>64</max_sessions>
<session_timeout>15m</session_timeout>
</rule_test>
<!-- ═══════════════════════════════════════════════════════════
AUTHENTIFICATION AGENTS (wazuh-authd)
═══════════════════════════════════════════════════════════ -->
<auth>
<disabled>no</disabled>
<port>1515</port>
<use_source_ip>no</use_source_ip>
<purge>yes</purge>
<use_password>no</use_password>
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
<ssl_verify_host>no</ssl_verify_host>
<ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
<ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
<ssl_auto_negotiate>no</ssl_auto_negotiate>
</auth>
<!-- ═══════════════════════════════════════════════════════════
CLUSTER (standalone — désactivé)
═══════════════════════════════════════════════════════════ -->
<cluster>
<name>wazuh</name>
<node_name>node01</node_name>
<node_type>master</node_type>
<key>aa093264ef885029653eea20dfcf51ae</key>
<port>1516</port>
<bind_addr>0.0.0.0</bind_addr>
<nodes>
<node>wazuh.manager</node>
</nodes>
<hidden>no</hidden>
<disabled>yes</disabled>
</cluster>
</ossec_config>
<ossec_config>
<localfile>
<log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location>
</localfile>
</ossec_config>
monitoring/security/wazuh/config/wazuh_manager/rules/local_active_response_rules.xml
-45
View File
@@ -1,45 +0,0 @@
<!-- ═══════════════════════════════════════════════════════════════════
Active-Response — règles de détection précoce pour l'AR graduée
═══════════════════════════════════════════════════════════════════
Ces règles viennent EN PLUS des bans existants sur les règles natives
(5710, 5716, etc.) pour produire des alertes clairement labellisées
et déclencher des AR spécifiques par scénario d'attaque.
-->
<!-- ─── SSH ─────────────────────────────────────────────────────────── -->
<group name="syslog,sshd,authentication_failures,">
<!-- 3 mots de passe incorrects en 60s depuis la même IP
Note : le ban PERMANENT sur 5716 (1ère tentative) reste actif en parallèle.
Cette règle produit une alerte "brute-force" explicite + AR temporaire graduée. -->
<rule id="100300" level="10" frequency="3" timeframe="60">
<if_matched_sid>5716</if_matched_sid>
<same_source_ip />
<description>SSH: brute-force — 3 mots de passe faux en 60s depuis $(srcip)</description>
<group>authentication_failures,ssh_brute,</group>
</rule>
<!-- 3 users inexistants en 60s depuis la même IP → scan de comptes -->
<rule id="100301" level="12" frequency="3" timeframe="60">
<if_matched_sid>5710</if_matched_sid>
<same_source_ip />
<description>SSH: scan de comptes — 3 users inexistants en 60s depuis $(srcip)</description>
<group>authentication_failures,ssh_scan,</group>
</rule>
</group>
<!-- ─── SUDO ─────────────────────────────────────────────────────────── -->
<group name="syslog,sudo,authentication_failures,">
<!-- 3 échecs sudo en 5 min par le même utilisateur.
Couverture non présente dans les règles natives → AR disable-account. -->
<rule id="100310" level="10" frequency="3" timeframe="300">
<if_matched_sid>5401</if_matched_sid>
<same_user />
<description>Sudo: 3 échecs d'auth en 5 min — tentative d'escalade de privilèges</description>
<group>authentication_failures,sudo_brute,</group>
</rule>
</group>
monitoring/security/wazuh/config/wazuh_manager/rules/local_modsecurity_rules.xml
-39
View File
@@ -1,39 +0,0 @@
<!-- ═══════════════════════════════════════════════════════════════
Règles ModSecurity — WAF container (gestion-waf)
Le decoder json intégré parse les events — on utilise <field> + <location>.
═══════════════════════════════════════════════════════════════ -->
<group name="web,modsecurity,">
<!-- Base : tout event JSON provenant du log ModSecurity -->
<rule id="100100" level="3">
<decoded_as>json</decoded_as>
<location>modsec_audit.log</location>
<field name="transaction.client_ip">\.+</field>
<description>ModSecurity: WAF event capturé</description>
<group>web,modsecurity,</group>
</rule>
<!-- Accès bloqué (HTTP 403) -->
<rule id="100102" level="10">
<if_sid>100100</if_sid>
<field name="transaction.response.http_code">^403$</field>
<description>ModSecurity: accès bloqué (403) — $(transaction.client_ip) → $(transaction.request.uri)</description>
<group>web,modsecurity,attack,blocked,</group>
</rule>
<!-- Trafic passant avec règle déclenchée (warning, anomaly scoring) -->
<rule id="100101" level="6">
<if_sid>100100</if_sid>
<description>ModSecurity: règle WAF déclenchée (non bloqué) — $(transaction.client_ip)</description>
<group>web,modsecurity,attack,</group>
</rule>
<!-- Blocages répétés depuis la même IP -->
<rule id="100103" level="12" frequency="5" timeframe="60">
<if_matched_sid>100102</if_matched_sid>
<description>ModSecurity: blocages répétés — possible scan ou attaque soutenue</description>
<group>web,modsecurity,attack,blocked,</group>
</rule>
</group>
monitoring/security/wazuh/config/wazuh_manager/rules/local_sca_noise.xml
-113
View File
@@ -1,113 +0,0 @@
<!-- ═══════════════════════════════════════════════════════════════════
Suppression des alertes SCA (Security Configuration Assessment)
═══════════════════════════════════════════════════════════════════
Les scans CIS benchmark génèrent des centaines d'alertes par cycle.
Toutes passées à level 0 — les résultats restent consultables dans
l'onglet SCA du dashboard sans polluer le flux d'alertes.
-->
<group name="sca,">
<!-- ─── Résumés de scan (score < 90%, <80%, <50%, <30%) ─────────── -->
<rule id="19001" level="0" overwrite="yes">
<if_sid>19000</if_sid>
<field name="sca.type">^summary</field>
<options>no_full_log</options>
<description>SCA summary — supprimé (voir onglet SCA du dashboard).</description>
</rule>
<rule id="19002" level="0" overwrite="yes">
<if_sid>19001</if_sid>
<field name="sca.score">^8\d</field>
<options>no_full_log</options>
<description>SCA summary: score &lt; 90% — supprimé.</description>
</rule>
<rule id="19003" level="0" overwrite="yes">
<if_sid>19001</if_sid>
<field name="sca.score">^7\d|^6\d|^5\d</field>
<options>no_full_log</options>
<description>SCA summary: score &lt; 80% — supprimé.</description>
</rule>
<rule id="19004" level="0" overwrite="yes">
<if_sid>19001</if_sid>
<field name="sca.score">^4\d|^3\d</field>
<options>no_full_log</options>
<description>SCA summary: score &lt; 50% — supprimé.</description>
</rule>
<rule id="19005" level="0" overwrite="yes">
<if_sid>19001</if_sid>
<field name="sca.score">^2\d|^1\d$|^\d$</field>
<options>no_full_log</options>
<description>SCA summary: score &lt; 30% — supprimé.</description>
</rule>
<!-- ─── Checks individuels (passed / failed / not applicable) ────── -->
<rule id="19007" level="0" overwrite="yes">
<if_sid>19006</if_sid>
<field name="sca.check.result">^failed</field>
<options>no_full_log</options>
<description>SCA check failed — supprimé.</description>
</rule>
<rule id="19008" level="0" overwrite="yes">
<if_sid>19006</if_sid>
<field name="sca.check.result">^passed</field>
<options>no_full_log</options>
<description>SCA check passed — supprimé.</description>
</rule>
<rule id="19009" level="0" overwrite="yes">
<if_sid>19006</if_sid>
<field name="sca.check.result">^not applicable</field>
<options>no_full_log</options>
<description>SCA check not applicable — supprimé.</description>
</rule>
<!-- ─── Changements de statut entre scans ───────────────────────── -->
<rule id="19010" level="0" overwrite="yes">
<if_sid>19008</if_sid>
<field name="sca.check.previous_result">^failed</field>
<options>no_full_log</options>
<description>SCA: failed → passed — supprimé.</description>
</rule>
<rule id="19011" level="0" overwrite="yes">
<if_sid>19007</if_sid>
<field name="sca.check.previous_result">^passed</field>
<options>no_full_log</options>
<description>SCA: passed → failed — supprimé.</description>
</rule>
<rule id="19012" level="0" overwrite="yes">
<if_sid>19009</if_sid>
<field name="sca.check.previous_result">^passed</field>
<options>no_full_log</options>
<description>SCA: passed → not applicable — supprimé.</description>
</rule>
<rule id="19013" level="0" overwrite="yes">
<if_sid>19009</if_sid>
<field name="sca.check.previous_result">^failed</field>
<options>no_full_log</options>
<description>SCA: failed → not applicable — supprimé.</description>
</rule>
<rule id="19014" level="0" overwrite="yes">
<if_sid>19007</if_sid>
<field name="sca.check.previous_result">^not applicable</field>
<options>no_full_log</options>
<description>SCA: not applicable → failed — supprimé.</description>
</rule>
<rule id="19015" level="0" overwrite="yes">
<if_sid>19008</if_sid>
<field name="sca.check.previous_result">^not applicable</field>
<options>no_full_log</options>
<description>SCA: not applicable → passed — supprimé.</description>
</rule>
</group>
monitoring/security/wazuh/config/wazuh_manager/rules/local_ssh_pam_noise.xml
-133
View File
@@ -1,133 +0,0 @@
<!-- ═══════════════════════════════════════════════════════════════════
Réduction du bruit SSH/PAM — overrides des règles natives Wazuh
═══════════════════════════════════════════════════════════════════
Supprimés (level 0) : événements sans valeur sécurité générés en masse
Conservés intacts : tout ce qui alimente l'active-response et la
détection de brute-force (5710, 5716, 5720, 5760, 5763…)
-->
<!-- ─── DPKG ───────────────────────────────────────────────────────────── -->
<group name="syslog,dpkg,">
<rule id="2901" level="0" overwrite="yes">
<if_sid>2900</if_sid>
<description>Dpkg: supprimé.</description>
</rule>
<rule id="2902" level="0" overwrite="yes">
<if_sid>2900</if_sid>
<description>Dpkg: supprimé.</description>
</rule>
<rule id="2903" level="0" overwrite="yes">
<if_sid>2900</if_sid>
<description>Dpkg: supprimé.</description>
</rule>
<rule id="2904" level="0" overwrite="yes">
<if_sid>2900</if_sid>
<description>Dpkg: supprimé.</description>
</rule>
</group>
<!-- ─── IP ADMIN (90.50.148.138) ─────────────────────────────────────── -->
<!-- Auth success supprimé pour l'IP admin : pas de valeur sécurité,
les échecs restent visibles si l'IP était usurpée. -->
<group name="syslog,sshd,">
<rule id="100010" level="0">
<if_sid>5715</if_sid>
<srcip>90.50.148.138</srcip>
<description>sshd: auth success IP admin — supprimé.</description>
</rule>
</group>
<!-- ─── PAM ──────────────────────────────────────────────────────────── -->
<group name="pam,syslog,">
<!-- 5501 (level 3) → PAM "session opened" : redondant avec 5715 sshd auth success -->
<rule id="5501" level="0" overwrite="yes">
<if_sid>5500</if_sid>
<match>session opened for user </match>
<description>PAM: Login session opened (bruit supprimé).</description>
</rule>
<!-- 5502 (level 3) → PAM "session closed" : purement informatif -->
<rule id="5502" level="0" overwrite="yes">
<if_sid>5500</if_sid>
<match>session closed for user </match>
<description>PAM: Login session closed (bruit supprimé).</description>
</rule>
</group>
<!-- ─── SSH ──────────────────────────────────────────────────────────── -->
<group name="syslog,sshd,">
<!-- 5704 (level 4) → timeout individuel : la règle de fréquence 5705
(level 10) continue de compter et d'alerter sur les patterns -->
<rule id="5704" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>fatal: Timeout before authentication for</match>
<description>sshd: Timeout individuel supprimé (fréquence 5705 active).</description>
</rule>
<!-- 5706 (level 6) → "Did not receive identification string" : scanners
qui touchent le port 22 sans finir le handshake, très fréquent -->
<rule id="5706" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>Did not receive identification string from</match>
<description>sshd: Sonde sans identification (bruit de scan supprimé).</description>
</rule>
<!-- 5740 (level 4) → connection reset by peer : bruit réseau/bots -->
<rule id="5740" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>Connection reset by peer$</match>
<description>sshd: Connection reset by peer (bruit supprimé).</description>
</rule>
<!-- 5741 (level 4) → connection refused : pas d'intérêt sur un agent -->
<rule id="5741" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>Connection refused$</match>
<description>sshd: Connection refused (bruit supprimé).</description>
</rule>
<!-- 5749 (level 4) → bad packet length : scanners/bots -->
<rule id="5749" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>^Bad packet length</match>
<description>sshd: Bad packet length (bruit de scan supprimé).</description>
</rule>
<!-- 5762 (level 4) → connection reset : doublon de 5740 -->
<rule id="5762" level="0" overwrite="yes">
<if_sid>5700</if_sid>
<match>Connection reset</match>
<description>sshd: Connection reset (bruit supprimé).</description>
</rule>
</group>
<!-- ─── IOC Suricata/Windows — parents exclus (0475, 0580, 0840) ──────────
IMPORTANT: <match>PLACEHOLDER_NEVER_MATCHES</match> au lieu de <match>.</match>
pour éviter que ces rules catch-all bloquent l'évaluation des rules avec
un ID plus élevé (first-match semantics dans Wazuh). -->
<group name="ids,">
<rule id="99917" level="0" overwrite="yes">
<match>WAZUH_PLACEHOLDER_SURICATA_NEVER_MATCHES</match>
<description>Suricata: malicious domain — overwrite placeholder (non applicable).</description>
</rule>
<rule id="99918" level="0" overwrite="yes">
<match>WAZUH_PLACEHOLDER_SURICATA_DNS_NEVER_MATCHES</match>
<description>Suricata: malicious domain DNS — overwrite placeholder (non applicable).</description>
</rule>
</group>
<group name="windows,windows_security,">
<rule id="99919" level="0" overwrite="yes">
<match>WAZUH_PLACEHOLDER_WINDOWS_FAILED_NEVER_MATCHES</match>
<description>Windows: failed logon malicious IP — overwrite placeholder (non applicable).</description>
</rule>
<rule id="99920" level="0" overwrite="yes">
<match>WAZUH_PLACEHOLDER_WINDOWS_SUCCESS_NEVER_MATCHES</match>
<description>Windows: successful logon malicious IP — overwrite placeholder (non applicable).</description>
</rule>
</group>
monitoring/security/wazuh/config/wazuh_manager/rules/modsecurity_rules.xml
-44
View File
@@ -1,44 +0,0 @@
<group name="web,modsecurity,attack,">
<!-- Règles spécialisées par type d'attaque — basées sur local_modsecurity_rules.xml (rule 100102) -->
<!-- SQL Injection bloquée -->
<rule id="100202" level="12">
<if_sid>100102</if_sid>
<field name="transaction.messages.message">SQL Injection\|SQLi\|942[0-9]</field>
<description>ModSecurity: SQL Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
<group>modsecurity_sqli,sql_injection,</group>
</rule>
<!-- XSS bloqué -->
<rule id="100203" level="12">
<if_sid>100102</if_sid>
<field name="transaction.messages.message">XSS\|941[0-9]</field>
<description>ModSecurity: XSS bloqué — $(transaction.client_ip) → $(transaction.request.uri)</description>
<group>modsecurity_xss,xss,</group>
</rule>
<!-- Remote Code Execution bloqué -->
<rule id="100204" level="14">
<if_sid>100102</if_sid>
<field name="transaction.messages.message">RCE\|930[0-9]\|932[0-9]</field>
<description>ModSecurity: tentative RCE bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
<group>modsecurity_rce,rce,</group>
</rule>
<!-- Local File Inclusion bloqué -->
<rule id="100205" level="12">
<if_sid>100102</if_sid>
<field name="transaction.messages.message">LFI\|930[0-9]</field>
<description>ModSecurity: LFI bloqué — $(transaction.client_ip) → $(transaction.request.uri)</description>
<group>modsecurity_lfi,lfi,</group>
</rule>
<!-- Blocages répétés — attaque soutenue -->
<rule id="100210" level="14" frequency="5" timeframe="120">
<if_matched_sid>100102</if_matched_sid>
<description>ModSecurity: blocages répétés en 2 min — attaque soutenue</description>
<group>modsecurity_repeated,</group>
</rule>
</group>
monitoring/security/wazuh/generate-certs.sh
-24
View File
@@ -1,24 +0,0 @@
#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CERTS_DIR="$SCRIPT_DIR/certs"
mkdir -p "$CERTS_DIR"
cd /tmp
echo "[*] Téléchargement de l'outil de génération de certificats Wazuh..."
curl -sO https://packages.wazuh.com/4.14/wazuh-certs-tool.sh
cp "$SCRIPT_DIR/config/certs.yml" config.yml
echo "[*] Génération des certificats..."
bash wazuh-certs-tool.sh -A
echo "[*] Copie des certificats..."
cp /tmp/wazuh-certificates/*.pem "$CERTS_DIR/"
cp /tmp/wazuh-certificates/root-ca.pem "$CERTS_DIR/root-ca-manager.pem"
chmod 640 "$CERTS_DIR"/*.pem
rm -rf /tmp/wazuh-certificates /tmp/wazuh-install-files /tmp/wazuh-install-files.tar /tmp/wazuh-certs-tool.sh /tmp/config.yml
echo "[OK] Certificats générés dans $CERTS_DIR"