diff --git a/monitoring/security/docker-compose-security.yml b/monitoring/security/docker-compose-security.yml index 40fd89f2..6374e631 100755 --- a/monitoring/security/docker-compose-security.yml +++ b/monitoring/security/docker-compose-security.yml @@ -102,7 +102,6 @@ services: - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - - crowdsec_logs:/var/log/crowdsec:ro - /var/run/docker.sock:/var/run/docker.sock - /usr/bin/docker:/usr/local/bin/docker:ro - ./wazuh/config/wazuh_manager/active-response:/wazuh-custom/active-response:ro @@ -171,40 +170,6 @@ services: networks: - monitoring_net - - # ─── CrowdSec LAPI ──────────────────────────────────────── - crowdsec: - image: crowdsecurity/crowdsec:latest - container_name: crowdsec - restart: unless-stopped - environment: - COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd" - GID: "0" - volumes: - - /var/log:/var/log/host:ro - - nginx_logs:/var/log/nginx:ro - - crowdsec_data:/var/lib/crowdsec/data - - crowdsec_config:/etc/crowdsec - - crowdsec_logs:/var/log/crowdsec - ports: - - "127.0.0.1:7777:8080" - - "10.0.0.2:8081:8080" - networks: - - monitoring_net - - # ─── CrowdSec Firewall Bouncer ──────────────────────────── - crowdsec-bouncer: - image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest - container_name: crowdsec-bouncer - restart: unless-stopped - network_mode: host - cap_add: - - NET_ADMIN - - NET_RAW - volumes: - - ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro - depends_on: - - crowdsec networks: monitoring_net: driver: bridge @@ -226,7 +191,4 @@ volumes: beszel_data: clamav_data: clamav_logs: - crowdsec_data: - crowdsec_config: - crowdsec_logs: uptime_kuma_data: diff --git a/monitoring/security/wazuh/active-response/crowdsec-ban.sh b/monitoring/security/wazuh/active-response/crowdsec-ban.sh deleted file mode 100755 index cedb2c99..00000000 --- a/monitoring/security/wazuh/active-response/crowdsec-ban.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/bin/bash -# Wazuh Active Response -> CrowdSec ban - -read INPUT - -SRC_IP=$(echo "$INPUT" | python3 -c " -import sys, json, re -try: - d = json.load(sys.stdin) - alert = d.get('parameters', {}).get('alert', {}) - data = alert.get('data', {}) - # 1. Try standard srcip field - ip = data.get('srcip') or data.get('src_ip') or '' - # 2. Fallback: extract first public IP from full_log - if not ip: - full_log = alert.get('full_log', '') - ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log) - private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)') - for candidate in ips: - if not private.match(candidate): - ip = candidate - break - print(ip) -except: - print('') -" 2>/dev/null) - -ACTION=$(echo "$INPUT" | python3 -c " -import sys, json -try: - d = json.load(sys.stdin) - print(d.get('command', 'add')) -except: - print('add') -" 2>/dev/null) - -LOG=/var/ossec/logs/active-responses.log - -if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then - echo "$(date) crowdsec-ban: no IP found" >> "$LOG" - exit 0 -fi - -# Ne pas bannir les IPs privees / VPN -if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then - echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG" - exit 0 -fi - -if [ "$ACTION" = "delete" ]; then - /usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null - echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG" -else - /usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \ - --duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG" - echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG" -fi diff --git a/monitoring/security/wazuh/config/wazuh_manager/active-response/crowdsec-ban.sh b/monitoring/security/wazuh/config/wazuh_manager/active-response/crowdsec-ban.sh deleted file mode 100755 index cedb2c99..00000000 --- a/monitoring/security/wazuh/config/wazuh_manager/active-response/crowdsec-ban.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/bin/bash -# Wazuh Active Response -> CrowdSec ban - -read INPUT - -SRC_IP=$(echo "$INPUT" | python3 -c " -import sys, json, re -try: - d = json.load(sys.stdin) - alert = d.get('parameters', {}).get('alert', {}) - data = alert.get('data', {}) - # 1. Try standard srcip field - ip = data.get('srcip') or data.get('src_ip') or '' - # 2. Fallback: extract first public IP from full_log - if not ip: - full_log = alert.get('full_log', '') - ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log) - private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)') - for candidate in ips: - if not private.match(candidate): - ip = candidate - break - print(ip) -except: - print('') -" 2>/dev/null) - -ACTION=$(echo "$INPUT" | python3 -c " -import sys, json -try: - d = json.load(sys.stdin) - print(d.get('command', 'add')) -except: - print('add') -" 2>/dev/null) - -LOG=/var/ossec/logs/active-responses.log - -if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then - echo "$(date) crowdsec-ban: no IP found" >> "$LOG" - exit 0 -fi - -# Ne pas bannir les IPs privees / VPN -if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then - echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG" - exit 0 -fi - -if [ "$ACTION" = "delete" ]; then - /usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null - echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG" -else - /usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \ - --duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG" - echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG" -fi diff --git a/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml b/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml deleted file mode 100644 index 8f3d7efa..00000000 --- a/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml +++ /dev/null @@ -1,38 +0,0 @@ - - - ^time="\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2} - - - - - crowdsec - ban on Ip - ban on Ip ([\d.]+) - srcip - - - - - crowdsec - ban on ip - ban on ip ([\d.]+) - srcip - - - - - crowdsec - overflow from - overflow from ([\d.]+) - srcip - - - - - crowdsec - level=(\S+) msg="(.+?)" - status,extra_data - diff --git a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf index 1223edcd..e8611ad3 100755 --- a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf +++ b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf @@ -761,119 +761,6 @@ 21600 - - - crowdsec-ban - crowdsec-ban.sh - yes - - - - - crowdsec-ban - local - 5710,5711,5712,5716,5720,5760,5763 - 86400 - - - - - crowdsec-ban - local - 100300,100301 - 86400 - - - - - crowdsec-ban - local - 100220,100290 - 86400 - - - - - crowdsec-ban - local - 100222,100292 - 0 - - - - - crowdsec-ban - local - 100230 - 86400 - - - - - crowdsec-ban - local - 100240,100241,100291 - 43200 - - - - - crowdsec-ban - local - 100250,100251,100252,100293 - 43200 - - - - - crowdsec-ban - local - 100260 - 43200 - - - - - crowdsec-ban - local - 100270,100280,100281 - 43200 - - - - - crowdsec-ban - local - 100202,100203,100204,100205,100206,100210 - 86400 - - - - - crowdsec-ban - local - 100610,100611,100612,100613 - 86400 - - - - - crowdsec-ban - local - 100501,100502 - 86400 - - - - - syslog - /var/log/crowdsec/crowdsec.log - - - 0565-aws-eks-authenticator_decoders.xml etc/decoders etc/rules diff --git a/monitoring/security/wazuh/config/wazuh_manager/rules/crowdsec-rules.xml b/monitoring/security/wazuh/config/wazuh_manager/rules/crowdsec-rules.xml deleted file mode 100644 index 6e388e10..00000000 --- a/monitoring/security/wazuh/config/wazuh_manager/rules/crowdsec-rules.xml +++ /dev/null @@ -1,42 +0,0 @@ - - - - - - /var/log/crowdsec/crowdsec.log - CrowdSec: event logged - - - - - 100500 - ban Ip |ban ip | ban on Ip |Ip ban - CrowdSec: IP banned by decision engine - crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d, - - - - - 100500 - overflow from |triggered |New overflow|crowdsecurity/ - CrowdSec: Attack scenario detected - crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d, - - - - - 100500 - level=error - CrowdSec: Error logged - crowdsec_error, - - - - - 100500 - level=fatal|level=panic - CrowdSec: Critical error — service may be down - crowdsec_error, - - - diff --git a/monitoring/security/wazuh/create-dashboard.py b/monitoring/security/wazuh/create-dashboard.py index d4330669..2b8d78a7 100644 --- a/monitoring/security/wazuh/create-dashboard.py +++ b/monitoring/security/wazuh/create-dashboard.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 """ -Crée le dashboard "Securite - Alertes Web et CrowdSec" dans OpenSearch Dashboards (Wazuh). +Crée le dashboard "Securite - Alertes Web et Firewall" dans OpenSearch Dashboards (Wazuh). Usage: python3 create-dashboard.py @@ -28,8 +28,8 @@ INDEX_PATTERN = "wazuh-alerts-*" # ── Queries de filtre ───────────────────────────────────────────────────────── Q_WEB = "rule.groups: web OR rule.groups: attack OR rule.groups: modsecurity OR rule.groups: api_brute_force" -Q_CS = "rule.groups: crowdsec OR rule.groups: crowdsec_ban" -Q_ALL = Q_WEB + " OR " + Q_CS +Q_FW = "rule.id: 651" +Q_ALL = Q_WEB + " OR " + Q_FW # ── Client HTTP ─────────────────────────────────────────────────────────────── ctx = ssl.create_default_context() @@ -85,9 +85,9 @@ VISUALIZATIONS = [ }, { "id": "sec-cs-count", - "title": "[Securite] CrowdSec - Total Bans", + "title": "[Securite] Firewall - Total Bans", "type": "metric", - "query": Q_CS, + "query": Q_FW, "visState": { "type": "metric", "params": { @@ -99,7 +99,7 @@ VISUALIZATIONS = [ "colorsRange": [{"from": 0, "to": 5}, {"from": 5, "to": 50}, {"from": 50, "to": 9999}], "labels": {"show": True}, "invertColors": False, - "style": {"bgFill": "#000", "bgColor": False, "labelColor": False, "subText": "bans crowdsec", "fontSize": 60}, + "style": {"bgFill": "#000", "bgColor": False, "labelColor": False, "subText": "bans firewall", "fontSize": 60}, } }, "aggs": [{"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}], @@ -163,9 +163,9 @@ VISUALIZATIONS = [ }, { "id": "sec-cs-bans-table", - "title": "[Securite] CrowdSec - IPs Bannies", + "title": "[Securite] Firewall - IPs Bannies", "type": "table", - "query": Q_CS, + "query": Q_FW, "visState": { "type": "table", "params": {"perPage": 20, "showPartialRows": False, "showMetricsAtAllLevels": False, "sort": {"columnIndex": None, "direction": None}, "showTotal": False, "totalFunc": "sum"}, @@ -206,7 +206,7 @@ PANELS = [ # ── Main ────────────────────────────────────────────────────────────────────── def main(): - print("=== Création du dashboard Securite - Alertes Web et CrowdSec ===\n") + print("=== Création du dashboard Securite - Alertes Web et Firewall ===\n") # Visualisations for viz in VISUALIZATIONS: @@ -231,8 +231,8 @@ def main(): # Dashboard dashboard_body = { "attributes": { - "title": "Securite - Alertes Web et CrowdSec", - "description": "Alertes OWASP ModSecurity brute-force API et bans CrowdSec", + "title": "Securite - Alertes Web et Firewall", + "description": "Alertes OWASP ModSecurity brute-force API et bans Firewall", "panelsJSON": json.dumps(PANELS), "optionsJSON": json.dumps({"useMargins": True, "hidePanelTitles": False}), "timeRestore": False,