diff --git a/monitoring/wazuh/config/wazuh_manager/ossec.conf b/monitoring/wazuh/config/wazuh_manager/ossec.conf
index cf206535..881aea68 100644
--- a/monitoring/wazuh/config/wazuh_manager/ossec.conf
+++ b/monitoring/wazuh/config/wazuh_manager/ossec.conf
@@ -219,6 +219,12 @@
     <timeout_allowed>yes</timeout_allowed>
   </command>
 
+  <command>
+    <name>clamav-quarantine</name>
+    <executable>clamav-quarantine</executable>
+    <timeout_allowed>no</timeout_allowed>
+  </command>
+
   <!-- ═══════════════════════════════════════════════════════════
        ACTIVE RESPONSE — RÈGLES
        ═══════════════════════════════════════════════════════════ -->
@@ -296,6 +302,13 @@
     <timeout>86400</timeout>
   </active-response>
 
+  <!-- ClamAV virus détecté → quarantaine du fichier infecté -->
+  <active-response>
+    <command>clamav-quarantine</command>
+    <location>local</location>
+    <rules_id>52502</rules_id>
+  </active-response>
+
   <!-- Attaque soutenue ModSec (5 blocs / 2 min) → firewall-drop 24 heures -->
   <active-response>
     <command>firewall-drop</command>
@@ -448,7 +461,6 @@
     <rule_exclude>0295-mysql_rules.xml</rule_exclude>
     <rule_exclude>0305-dropbear_rules.xml</rule_exclude>
     <rule_exclude>0315-apparmor_rules.xml</rule_exclude>
-    <rule_exclude>0320-clam_av_rules.xml</rule_exclude>
     <rule_exclude>0350-amazon_rules.xml</rule_exclude>
     <rule_exclude>0360-serv-u_rules.xml</rule_exclude>
     <rule_exclude>0385-oscap_rules.xml</rule_exclude>