chore: fix bug
This commit is contained in:
Nuxgrid
@@ -1,57 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Active Response -> CrowdSec ban
|
||||
|
||||
read INPUT
|
||||
|
||||
SRC_IP=$(echo "$INPUT" | python3 -c "
|
||||
import sys, json, re
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
alert = d.get('parameters', {}).get('alert', {})
|
||||
data = alert.get('data', {})
|
||||
# 1. Try standard srcip field
|
||||
ip = data.get('srcip') or data.get('src_ip') or ''
|
||||
# 2. Fallback: extract first public IP from full_log
|
||||
if not ip:
|
||||
full_log = alert.get('full_log', '')
|
||||
ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
|
||||
private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
|
||||
for candidate in ips:
|
||||
if not private.match(candidate):
|
||||
ip = candidate
|
||||
break
|
||||
print(ip)
|
||||
except:
|
||||
print('')
|
||||
" 2>/dev/null)
|
||||
|
||||
ACTION=$(echo "$INPUT" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
print(d.get('command', 'add'))
|
||||
except:
|
||||
print('add')
|
||||
" 2>/dev/null)
|
||||
|
||||
LOG=/var/ossec/logs/active-responses.log
|
||||
|
||||
if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
|
||||
echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Ne pas bannir les IPs privees / VPN
|
||||
if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
|
||||
echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$ACTION" = "delete" ]; then
|
||||
/usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
|
||||
echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
|
||||
else
|
||||
/usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
|
||||
--duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
|
||||
echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
|
||||
fi
|
||||
@@ -1,38 +0,0 @@
|
||||
<!-- CrowdSec Decoders — format logrus key=value
|
||||
Le decoder natif aws-eks-authenticator est exclu dans ossec.conf
|
||||
(<decoder_exclude>) car son prematch pcre2 capture aussi ce format.
|
||||
Ce decoder root "crowdsec" prend donc la main. -->
|
||||
<decoder name="crowdsec">
|
||||
<prematch type="pcre2">^time="\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}</prematch>
|
||||
</decoder>
|
||||
|
||||
<!-- Ban CrowdSec : format "... : Xh ban on Ip A.B.C.D" (module db) -->
|
||||
<decoder name="crowdsec-ban">
|
||||
<parent>crowdsec</parent>
|
||||
<prematch>ban on Ip </prematch>
|
||||
<regex type="pcre2">ban on Ip ([\d.]+)</regex>
|
||||
<order>srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Ban CrowdSec : variante minuscule "ban on ip A.B.C.D" -->
|
||||
<decoder name="crowdsec-ban-lc">
|
||||
<parent>crowdsec</parent>
|
||||
<prematch>ban on ip </prematch>
|
||||
<regex type="pcre2">ban on ip ([\d.]+)</regex>
|
||||
<order>srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Overflow CrowdSec -->
|
||||
<decoder name="crowdsec-overflow">
|
||||
<parent>crowdsec</parent>
|
||||
<prematch>overflow from </prematch>
|
||||
<regex type="pcre2">overflow from ([\d.]+)</regex>
|
||||
<order>srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Champs generaux level/msg pour les logs non-ban -->
|
||||
<decoder name="crowdsec-fields">
|
||||
<parent>crowdsec</parent>
|
||||
<regex type="pcre2">level=(\S+) msg="(.+?)"</regex>
|
||||
<order>status,extra_data</order>
|
||||
</decoder>
|
||||
@@ -761,119 +761,6 @@
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ════════════════════════════════════════════════════════════
|
||||
CROWDSEC ACTIVE RESPONSE
|
||||
════════════════════════════════════════════════════════════ -->
|
||||
<command>
|
||||
<name>crowdsec-ban</name>
|
||||
<executable>crowdsec-ban.sh</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<!-- SSH Brute Force → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- SSH brute-force custom (100300) + scan comptes (100301) → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100300,100301</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP SQLi (100220,100290) → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100220,100290</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP Command Injection (100222,100292) → CrowdSec ban permanent -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100222,100292</rules_id>
|
||||
<timeout>0</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP RCE/Exploit (100230) → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100230</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP XSS (100240,100241,100291) → CrowdSec ban 12h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100240,100241,100291</rules_id>
|
||||
<timeout>43200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP LFI/RFI/Path Traversal (100250,100251,100252,100293) → CrowdSec ban 12h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100250,100251,100252,100293</rules_id>
|
||||
<timeout>43200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP XXE (100260) → CrowdSec ban 12h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100260</rules_id>
|
||||
<timeout>43200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP Scanner/SSRF/Upload (100270,100280,100281) → CrowdSec ban 12h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100270,100280,100281</rules_id>
|
||||
<timeout>43200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ModSec attaque soutenue (100210) → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100202,100203,100204,100205,100206,100210</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- API brute-force login (100610,100611,100612,100613) → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100610,100611,100612,100613</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- CrowdSec ban détecté dans ses propres logs → renforcer le ban 24h -->
|
||||
<active-response>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100501,100502</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ════════════════════════════════════════════════════════════
|
||||
CROWDSEC LOG MONITORING
|
||||
════════════════════════════════════════════════════════════ -->
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||
</localfile>
|
||||
|
||||
|
||||
<!-- ═══════════════════════════════════════════════════════════
|
||||
LOG ANALYSIS (commandes système)
|
||||
@@ -1013,10 +900,6 @@
|
||||
<list>etc/lists/malicious-ioc/malicious-domains</list>
|
||||
<list>etc/lists/malicious-ioc/malware-hashes</list>
|
||||
<list>etc/lists/wireguard-trusted-ips</list>
|
||||
<!-- Exclusion du decoder natif aws-eks-authenticator : son prematch pcre2
|
||||
time="\d{4}-\d{2}-\d{2}T..." capture aussi les logs logrus CrowdSec,
|
||||
empechant notre decoder crowdsec-ban d'extraire data.srcip. -->
|
||||
<decoder_exclude>0565-aws-eks-authenticator_decoders.xml</decoder_exclude>
|
||||
<!-- Decoders et règles custom ModSecurity -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
<!-- CrowdSec Rules — IDs 100500-100509 -->
|
||||
<group name="crowdsec,">
|
||||
|
||||
<!-- Base: logs CrowdSec/logrus (pattern simple, sans \d) -->
|
||||
<rule id="100500" level="3">
|
||||
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||
<description>CrowdSec: event logged</description>
|
||||
</rule>
|
||||
|
||||
<!-- IP bannie par CrowdSec -->
|
||||
<rule id="100501" level="10">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>ban Ip |ban ip | ban on Ip |Ip ban</match>
|
||||
<description>CrowdSec: IP banned by decision engine</description>
|
||||
<group>crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Nouvelle attaque detectee -->
|
||||
<rule id="100502" level="8">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>overflow from |triggered |New overflow|crowdsecurity/</match>
|
||||
<description>CrowdSec: Attack scenario detected</description>
|
||||
<group>crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Erreur CrowdSec -->
|
||||
<rule id="100503" level="7">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>level=error</match>
|
||||
<description>CrowdSec: Error logged</description>
|
||||
<group>crowdsec_error,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Erreur critique CrowdSec -->
|
||||
<rule id="100504" level="12">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>level=fatal|level=panic</match>
|
||||
<description>CrowdSec: Critical error — service may be down</description>
|
||||
<group>crowdsec_error,</group>
|
||||
</rule>
|
||||
|
||||
</group>
|
||||
Reference in New Issue
Block a user