From 2d67c451e52dfc0806a0a4e8a61e976c6fe3b570 Mon Sep 17 00:00:00 2001
From: Xor290 <free6nk33@gmail.com>
Date: Fri, 8 May 2026 19:24:01 +0200
Subject: [PATCH] chore: update wazuh conf

---
 monitoring/wazuh/config/wazuh_manager/ossec.conf | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/monitoring/wazuh/config/wazuh_manager/ossec.conf b/monitoring/wazuh/config/wazuh_manager/ossec.conf
index cf206535..881aea68 100644
--- a/monitoring/wazuh/config/wazuh_manager/ossec.conf
+++ b/monitoring/wazuh/config/wazuh_manager/ossec.conf
@@ -219,6 +219,12 @@
     <timeout_allowed>yes</timeout_allowed>
   </command>
 
+  <command>
+    <name>clamav-quarantine</name>
+    <executable>clamav-quarantine</executable>
+    <timeout_allowed>no</timeout_allowed>
+  </command>
+
   <!-- ═══════════════════════════════════════════════════════════
        ACTIVE RESPONSE — RÈGLES
        ═══════════════════════════════════════════════════════════ -->
@@ -296,6 +302,13 @@
     <timeout>86400</timeout>
   </active-response>
 
+  <!-- ClamAV virus détecté → quarantaine du fichier infecté -->
+  <active-response>
+    <command>clamav-quarantine</command>
+    <location>local</location>
+    <rules_id>52502</rules_id>
+  </active-response>
+
   <!-- Attaque soutenue ModSec (5 blocs / 2 min) → firewall-drop 24 heures -->
   <active-response>
     <command>firewall-drop</command>
@@ -448,7 +461,6 @@
     <rule_exclude>0295-mysql_rules.xml</rule_exclude>
     <rule_exclude>0305-dropbear_rules.xml</rule_exclude>
     <rule_exclude>0315-apparmor_rules.xml</rule_exclude>
-    <rule_exclude>0320-clam_av_rules.xml</rule_exclude>
     <rule_exclude>0350-amazon_rules.xml</rule_exclude>
     <rule_exclude>0360-serv-u_rules.xml</rule_exclude>
     <rule_exclude>0385-oscap_rules.xml</rule_exclude>