chore: update

2026-06-10 17:50:44 +02:00
parent 9b4e2c4811
commit 78bd98e72f
40 changed files with 3661 additions and 380 deletions
@@ -0,0 +1,10 @@
+nodes:
+  indexer:
+    - name: wazuh.indexer
+      ip: "wazuh.indexer"
+  server:
+    - name: wazuh.manager
+      ip: "wazuh.manager"
+  dashboard:
+    - name: wazuh.dashboard
+      ip: "wazuh.dashboard"
@@ -0,0 +1,12 @@
+server.host: 0.0.0.0
+server.port: 5601
+opensearch.hosts: https://wazuh.indexer:9200
+opensearch.ssl.verificationMode: certificate
+opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
+opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
+opensearch_security.multitenancy.enabled: false
+opensearch_security.readonly_mode.roles: ["kibana_read_only"]
+server.ssl.enabled: true
+server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
+server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
+uiSettings.overrides.defaultRoute: /app/wz-home
@@ -0,0 +1,45 @@
+---
+_meta:
+  type: "internalusers"
+  config_version: 2
+
+admin:
+  hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
+  reserved: true
+  backend_roles:
+    - "admin"
+  description: "Admin user"
+
+kibanaserver:
+  hash: "$2b$12$czi/zi7uht/K5.vcCvsXueFi6ot7GFwFfVBax7rCaNqBq1jhTOZ7u"
+  reserved: true
+  description: "Kibanaserver user"
+
+kibanaro:
+  hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
+  reserved: false
+  backend_roles:
+    - "kibanauser"
+    - "readall"
+  description: "Kibana read-only user"
+
+logstash:
+  hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
+  reserved: false
+  backend_roles:
+    - "logstash"
+  description: "Logstash user"
+
+readall:
+  hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
+  reserved: false
+  backend_roles:
+    - "readall"
+  description: "Readall user"
+
+snapshotrestore:
+  hash: "$2b$12$lNbkFg7B3IN.BXwZHjztteTDd3hTIvT/kTJhRFqfUY/228Bw45POO"
+  reserved: false
+  backend_roles:
+    - "snapshotrestore"
+  description: "Snapshotrestore user"
@@ -0,0 +1,51 @@
+network.host: "0.0.0.0"
+node.name: "wazuh.indexer"
+cluster.name: "wazuh-cluster"
+
+# Compatibilité Filebeat 7.x (libbeat) avec OpenSearch 2.x
+# Filebeat envoie _type dans les requêtes bulk — OpenSearch 2.x le rejette
+# sans ce flag.
+compatibility.override_main_response_version: true
+
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+
+plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+
+plugins.security.authcz.admin_dn:
+  - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
+plugins.security.nodes_dn:
+  - "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
+
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.restapi.roles_enabled:
+  - "all_access"
+  - "security_rest_api_access"
+
+plugins.security.system_indices.enabled: true
+plugins.security.system_indices.indices:
+  - ".opendistro-alerting-config"
+  - ".opendistro-alerting-alert*"
+  - ".opendistro-anomaly-results*"
+  - ".opendistro-anomaly-detector*"
+  - ".opendistro-anomaly-checkpoints"
+  - ".opendistro-anomaly-detection-state"
+  - ".opendistro-reports-*"
+  - ".opendistro-notifications-*"
+  - ".opendistro-notebooks"
+  - ".opensearch-observability"
+  - ".opendistro-asynchronous-search-response*"
+  - ".replication-metadata-store"
+
+discovery.type: single-node
+plugins.security.allow_default_init_securityindex: true
+cluster.routing.allocation.disk.threshold_enabled: false
@@ -0,0 +1,4 @@
+<!-- ModSecurity decoder — non utilisé, remplacé par règles json+location -->
+<decoder name="waf-modsec-unused">
+  <prematch>UNUSED_MODSEC_PLACEHOLDER_NEVER_MATCHES</prematch>
+</decoder>
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -e
+
+# ─── Copie de la config custom (montée hors du volume wazuh_etc) ──────────────
+CUSTOM=/wazuh-custom
+
+cp "$CUSTOM/ossec.conf" /var/ossec/etc/ossec.conf
+
+mkdir -p /var/ossec/etc/decoders /var/ossec/etc/rules
+cp "$CUSTOM/decoders/"*.xml /var/ossec/etc/decoders/ 2>/dev/null || true
+cp "$CUSTOM/rules/"*.xml    /var/ossec/etc/rules/    2>/dev/null || true
+
+# ─── Démarrage Wazuh Manager (entrypoint original) ────────────────────────────
+exec /init
@@ -0,0 +1,23 @@
+<!-- ClamAV Log Monitoring -->
+<!-- Collect ClamAV logs for antivirus detection -->
+
+<!-- ClamAV Main Log -->
+<localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/clamav/clamav.log</location>
+    <source_type>log</source_type>
+</localfile>
+
+<!-- ClamAV Freshclam (Signature Updates) Log -->
+<localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/clamav/freshclam.log</location>
+    <source_type>log</source_type>
+</localfile>
+
+<!-- ClamAV Alert Log (High Priority Detections) -->
+<localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/clamav/alert.log</location>
+    <source_type>log</source_type>
+</localfile>
@@ -0,0 +1,143 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="clamav">
+  <rule id="100500" level="0">
+    <decoded_as>syslog</decoded_as>
+    <program_name>clam</program_name>
+    <description>ClamAV message grouping</description>
+  </rule>
+
+  <!-- ClamAV Malware Detections (Critical) -->
+  <rule id="100501" level="15">
+    <parent>100500</parent>
+    <regex>FOUND|Infected|detected</regex>
+    <description>ClamAV: Malware detected - $(var malware_name)</description>
+    <group>malware,clamav,infection</group>
+  </rule>
+
+  <!-- ClamAV Trojan/PUA Detection -->
+  <rule id="100502" level="12">
+    <parent>100500</parent>
+    <regex>Trojan|PUA|unwanted|grayware</regex>
+    <description>ClamAV: Potentially Unwanted Application detected</description>
+    <group>malware,clamav,pua</group>
+  </rule>
+
+  <!-- ClamAV Virus Detection -->
+  <rule id="100503" level="15">
+    <parent>100500</parent>
+    <regex>\.Virus\.|\.Win\.|\.Linux\.|\.Worm\.|\.Backdoor</regex>
+    <description>ClamAV: Virus detected - High severity</description>
+    <group>malware,clamav,virus</group>
+  </rule>
+
+  <!-- ClamAV Ransomware Detection -->
+  <rule id="100504" level="15">
+    <parent>100500</parent>
+    <regex>Ransomware|Encrypted|Cryptolocker|BadRabbit|WannaCry</regex>
+    <description>ClamAV: Ransomware detected</description>
+    <group>malware,clamav,ransomware</group>
+  </rule>
+
+  <!-- ClamAV Signature Update Success -->
+  <rule id="100505" level="3">
+    <parent>100500</parent>
+    <program_name>freshclam</program_name>
+    <regex>ClamAV update completed successfully|updated</regex>
+    <description>ClamAV: Signature database updated successfully</description>
+    <group>clamav,updates</group>
+  </rule>
+
+  <!-- ClamAV Signature Update Failed -->
+  <rule id="100506" level="10">
+    <parent>100500</parent>
+    <program_name>freshclam</program_name>
+    <regex>ERROR|Failed|error downloading|connection failed|timeout</regex>
+    <description>ClamAV: Signature update failed</description>
+    <group>clamav,updates,error</group>
+  </rule>
+
+  <!-- ClamAV Daemon Error -->
+  <rule id="100507" level="8">
+    <parent>100500</parent>
+    <program_name>clamd</program_name>
+    <regex>ERROR|error|CRITICAL</regex>
+    <description>ClamAV: Daemon error</description>
+    <group>clamav,error</group>
+  </rule>
+
+  <!-- ClamAV Scanner Started -->
+  <rule id="100508" level="3">
+    <parent>100500</parent>
+    <regex>Scanning started|initializing scanner</regex>
+    <description>ClamAV: Scanning started</description>
+    <group>clamav,scanning</group>
+  </rule>
+
+  <!-- ClamAV Scanner Completed -->
+  <rule id="100509" level="3">
+    <parent>100500</parent>
+    <regex>Scanning finished|scan completed</regex>
+    <description>ClamAV: Scanning completed</description>
+    <group>clamav,scanning</group>
+  </rule>
+
+  <!-- ClamAV Corrupted Files Alert -->
+  <rule id="100510" level="8">
+    <parent>100500</parent>
+    <regex>corrupted|corrupt file|damaged|unreadable</regex>
+    <description>ClamAV: Corrupted file detected</description>
+    <group>clamav,corruption</group>
+  </rule>
+
+  <!-- ClamAV Quarantine Actions -->
+  <rule id="100511" level="10">
+    <parent>100500</parent>
+    <regex>quarantine|moved|removed|deleted|archived</regex>
+    <description>ClamAV: File quarantined/removed</description>
+    <group>clamav,quarantine,action</group>
+  </rule>
+
+  <!-- ClamAV Scan Statistics -->
+  <rule id="100512" level="3">
+    <parent>100500</parent>
+    <regex>infects|infected files|detected</regex>
+    <description>ClamAV: Scan statistics</description>
+    <group>clamav,statistics</group>
+  </rule>
+
+  <!-- ClamAV Permission Denied -->
+  <rule id="100513" level="6">
+    <parent>100500</parent>
+    <regex>Permission denied|access denied|unable to scan</regex>
+    <description>ClamAV: Permission denied when scanning file</description>
+    <group>clamav,access</group>
+  </rule>
+
+  <!-- ClamAV Database Problem -->
+  <rule id="100514" level="10">
+    <parent>100500</parent>
+    <regex>database error|bad database|corrupt database|outdated database</regex>
+    <description>ClamAV: Database problem detected</description>
+    <group>clamav,database,error</group>
+  </rule>
+
+  <!-- Aggregate: Multiple Malware Detections in Short Time -->
+  <rule id="100515" level="16">
+    <parent>100501</parent>
+    <frequency>3</timeframe>3600</frequency>
+    <same_source_ip />
+    <description>ClamAV: Multiple malware detections in short time - possible outbreak</description>
+    <group>malware,clamav,outbreak</group>
+  </rule>
+
+  <!-- Aggregate: Ransomware Alert with Infection -->
+  <rule id="100516" level="16">
+    <if_matched_sid>100501</if_matched_sid>
+    <if_matched_sid>100504</if_matched_sid>
+    <same_source_ip />
+    <timeframe>300</timeframe>
+    <description>ClamAV: Ransomware and virus detected together - critical threat</description>
+    <group>malware,clamav,ransomware,critical</group>
+  </rule>
+
+</group>
@@ -0,0 +1,45 @@
+<!-- ═══════════════════════════════════════════════════════════════════
+     Active-Response — règles de détection précoce pour l'AR graduée
+     ═══════════════════════════════════════════════════════════════════
+
+     Ces règles viennent EN PLUS des bans existants sur les règles natives
+     (5710, 5716, etc.) pour produire des alertes clairement labellisées
+     et déclencher des AR spécifiques par scénario d'attaque.
+-->
+
+<!-- ─── SSH ─────────────────────────────────────────────────────────── -->
+<group name="syslog,sshd,authentication_failures,">
+
+  <!-- 3 mots de passe incorrects en 60s depuis la même IP
+       Note : le ban PERMANENT sur 5716 (1ère tentative) reste actif en parallèle.
+       Cette règle produit une alerte "brute-force" explicite + AR temporaire graduée. -->
+  <rule id="100300" level="10" frequency="3" timeframe="60">
+    <if_matched_sid>5716</if_matched_sid>
+    <same_source_ip />
+    <description>SSH: brute-force — 3 mots de passe faux en 60s depuis $(srcip)</description>
+    <group>authentication_failures,ssh_brute,</group>
+  </rule>
+
+  <!-- 3 users inexistants en 60s depuis la même IP → scan de comptes -->
+  <rule id="100301" level="12" frequency="3" timeframe="60">
+    <if_matched_sid>5710</if_matched_sid>
+    <same_source_ip />
+    <description>SSH: scan de comptes — 3 users inexistants en 60s depuis $(srcip)</description>
+    <group>authentication_failures,ssh_scan,</group>
+  </rule>
+
+</group>
+
+<!-- ─── SUDO ─────────────────────────────────────────────────────────── -->
+<group name="syslog,sudo,authentication_failures,">
+
+  <!-- 3 échecs sudo en 5 min par le même utilisateur.
+       Couverture non présente dans les règles natives → AR disable-account. -->
+  <rule id="100310" level="10" frequency="3" timeframe="300">
+    <if_matched_sid>5401</if_matched_sid>
+    <same_user />
+    <description>Sudo: 3 échecs d'auth en 5 min — tentative d'escalade de privilèges</description>
+    <group>authentication_failures,sudo_brute,</group>
+  </rule>
+
+</group>
@@ -0,0 +1,39 @@
+<!-- ═══════════════════════════════════════════════════════════════
+     Règles ModSecurity — WAF container (gestion-waf)
+     Le decoder json intégré parse les events — on utilise <field> + <location>.
+     ═══════════════════════════════════════════════════════════════ -->
+
+<group name="web,modsecurity,">
+
+  <!-- Base : tout event JSON provenant du log ModSecurity -->
+  <rule id="100100" level="3">
+    <decoded_as>json</decoded_as>
+    <location>modsec_audit.log</location>
+    <field name="transaction.client_ip">\.+</field>
+    <description>ModSecurity: WAF event capturé</description>
+    <group>web,modsecurity,</group>
+  </rule>
+
+  <!-- Accès bloqué (HTTP 403) -->
+  <rule id="100102" level="10">
+    <if_sid>100100</if_sid>
+    <field name="transaction.response.http_code">^403$</field>
+    <description>ModSecurity: accès bloqué (403) — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>web,modsecurity,attack,blocked,</group>
+  </rule>
+
+  <!-- Trafic passant avec règle déclenchée (warning, anomaly scoring) -->
+  <rule id="100101" level="6">
+    <if_sid>100100</if_sid>
+    <description>ModSecurity: règle WAF déclenchée (non bloqué) — $(transaction.client_ip)</description>
+    <group>web,modsecurity,attack,</group>
+  </rule>
+
+  <!-- Blocages répétés depuis la même IP -->
+  <rule id="100103" level="12" frequency="5" timeframe="60">
+    <if_matched_sid>100102</if_matched_sid>
+    <description>ModSecurity: blocages répétés — possible scan ou attaque soutenue</description>
+    <group>web,modsecurity,attack,blocked,</group>
+  </rule>
+
+</group>
@@ -0,0 +1,113 @@
+<!-- ═══════════════════════════════════════════════════════════════════
+     Suppression des alertes SCA (Security Configuration Assessment)
+     ═══════════════════════════════════════════════════════════════════
+
+     Les scans CIS benchmark génèrent des centaines d'alertes par cycle.
+     Toutes passées à level 0 — les résultats restent consultables dans
+     l'onglet SCA du dashboard sans polluer le flux d'alertes.
+-->
+
+<group name="sca,">
+
+  <!-- ─── Résumés de scan (score < 90%, <80%, <50%, <30%) ─────────── -->
+  <rule id="19001" level="0" overwrite="yes">
+    <if_sid>19000</if_sid>
+    <field name="sca.type">^summary</field>
+    <options>no_full_log</options>
+    <description>SCA summary — supprimé (voir onglet SCA du dashboard).</description>
+  </rule>
+
+  <rule id="19002" level="0" overwrite="yes">
+    <if_sid>19001</if_sid>
+    <field name="sca.score">^8\d</field>
+    <options>no_full_log</options>
+    <description>SCA summary: score &lt; 90% — supprimé.</description>
+  </rule>
+
+  <rule id="19003" level="0" overwrite="yes">
+    <if_sid>19001</if_sid>
+    <field name="sca.score">^7\d|^6\d|^5\d</field>
+    <options>no_full_log</options>
+    <description>SCA summary: score &lt; 80% — supprimé.</description>
+  </rule>
+
+  <rule id="19004" level="0" overwrite="yes">
+    <if_sid>19001</if_sid>
+    <field name="sca.score">^4\d|^3\d</field>
+    <options>no_full_log</options>
+    <description>SCA summary: score &lt; 50% — supprimé.</description>
+  </rule>
+
+  <rule id="19005" level="0" overwrite="yes">
+    <if_sid>19001</if_sid>
+    <field name="sca.score">^2\d|^1\d$|^\d$</field>
+    <options>no_full_log</options>
+    <description>SCA summary: score &lt; 30% — supprimé.</description>
+  </rule>
+
+  <!-- ─── Checks individuels (passed / failed / not applicable) ────── -->
+  <rule id="19007" level="0" overwrite="yes">
+    <if_sid>19006</if_sid>
+    <field name="sca.check.result">^failed</field>
+    <options>no_full_log</options>
+    <description>SCA check failed — supprimé.</description>
+  </rule>
+
+  <rule id="19008" level="0" overwrite="yes">
+    <if_sid>19006</if_sid>
+    <field name="sca.check.result">^passed</field>
+    <options>no_full_log</options>
+    <description>SCA check passed — supprimé.</description>
+  </rule>
+
+  <rule id="19009" level="0" overwrite="yes">
+    <if_sid>19006</if_sid>
+    <field name="sca.check.result">^not applicable</field>
+    <options>no_full_log</options>
+    <description>SCA check not applicable — supprimé.</description>
+  </rule>
+
+  <!-- ─── Changements de statut entre scans ───────────────────────── -->
+  <rule id="19010" level="0" overwrite="yes">
+    <if_sid>19008</if_sid>
+    <field name="sca.check.previous_result">^failed</field>
+    <options>no_full_log</options>
+    <description>SCA: failed → passed — supprimé.</description>
+  </rule>
+
+  <rule id="19011" level="0" overwrite="yes">
+    <if_sid>19007</if_sid>
+    <field name="sca.check.previous_result">^passed</field>
+    <options>no_full_log</options>
+    <description>SCA: passed → failed — supprimé.</description>
+  </rule>
+
+  <rule id="19012" level="0" overwrite="yes">
+    <if_sid>19009</if_sid>
+    <field name="sca.check.previous_result">^passed</field>
+    <options>no_full_log</options>
+    <description>SCA: passed → not applicable — supprimé.</description>
+  </rule>
+
+  <rule id="19013" level="0" overwrite="yes">
+    <if_sid>19009</if_sid>
+    <field name="sca.check.previous_result">^failed</field>
+    <options>no_full_log</options>
+    <description>SCA: failed → not applicable — supprimé.</description>
+  </rule>
+
+  <rule id="19014" level="0" overwrite="yes">
+    <if_sid>19007</if_sid>
+    <field name="sca.check.previous_result">^not applicable</field>
+    <options>no_full_log</options>
+    <description>SCA: not applicable → failed — supprimé.</description>
+  </rule>
+
+  <rule id="19015" level="0" overwrite="yes">
+    <if_sid>19008</if_sid>
+    <field name="sca.check.previous_result">^not applicable</field>
+    <options>no_full_log</options>
+    <description>SCA: not applicable → passed — supprimé.</description>
+  </rule>
+
+</group>
@@ -0,0 +1,133 @@
+<!-- ═══════════════════════════════════════════════════════════════════
+     Réduction du bruit SSH/PAM — overrides des règles natives Wazuh
+     ═══════════════════════════════════════════════════════════════════
+
+     Supprimés (level 0) : événements sans valeur sécurité générés en masse
+     Conservés intacts   : tout ce qui alimente l'active-response et la
+                           détection de brute-force (5710, 5716, 5720, 5760, 5763…)
+-->
+
+<!-- ─── DPKG ───────────────────────────────────────────────────────────── -->
+<group name="syslog,dpkg,">
+  <rule id="2901" level="0" overwrite="yes">
+    <if_sid>2900</if_sid>
+    <description>Dpkg: supprimé.</description>
+  </rule>
+  <rule id="2902" level="0" overwrite="yes">
+    <if_sid>2900</if_sid>
+    <description>Dpkg: supprimé.</description>
+  </rule>
+  <rule id="2903" level="0" overwrite="yes">
+    <if_sid>2900</if_sid>
+    <description>Dpkg: supprimé.</description>
+  </rule>
+  <rule id="2904" level="0" overwrite="yes">
+    <if_sid>2900</if_sid>
+    <description>Dpkg: supprimé.</description>
+  </rule>
+</group>
+
+<!-- ─── IP ADMIN (90.50.148.138) ─────────────────────────────────────── -->
+<!-- Auth success supprimé pour l'IP admin : pas de valeur sécurité,
+     les échecs restent visibles si l'IP était usurpée. -->
+<group name="syslog,sshd,">
+  <rule id="100010" level="0">
+    <if_sid>5715</if_sid>
+    <srcip>90.50.148.138</srcip>
+    <description>sshd: auth success IP admin — supprimé.</description>
+  </rule>
+</group>
+
+<!-- ─── PAM ──────────────────────────────────────────────────────────── -->
+<group name="pam,syslog,">
+
+  <!-- 5501 (level 3) → PAM "session opened" : redondant avec 5715 sshd auth success -->
+  <rule id="5501" level="0" overwrite="yes">
+    <if_sid>5500</if_sid>
+    <match>session opened for user </match>
+    <description>PAM: Login session opened (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5502 (level 3) → PAM "session closed" : purement informatif -->
+  <rule id="5502" level="0" overwrite="yes">
+    <if_sid>5500</if_sid>
+    <match>session closed for user </match>
+    <description>PAM: Login session closed (bruit supprimé).</description>
+  </rule>
+
+</group>
+
+<!-- ─── SSH ──────────────────────────────────────────────────────────── -->
+<group name="syslog,sshd,">
+
+  <!-- 5704 (level 4) → timeout individuel : la règle de fréquence 5705
+       (level 10) continue de compter et d'alerter sur les patterns -->
+  <rule id="5704" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>fatal: Timeout before authentication for</match>
+    <description>sshd: Timeout individuel supprimé (fréquence 5705 active).</description>
+  </rule>
+
+  <!-- 5706 (level 6) → "Did not receive identification string" : scanners
+       qui touchent le port 22 sans finir le handshake, très fréquent -->
+  <rule id="5706" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Did not receive identification string from</match>
+    <description>sshd: Sonde sans identification (bruit de scan supprimé).</description>
+  </rule>
+
+  <!-- 5740 (level 4) → connection reset by peer : bruit réseau/bots -->
+  <rule id="5740" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection reset by peer$</match>
+    <description>sshd: Connection reset by peer (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5741 (level 4) → connection refused : pas d'intérêt sur un agent -->
+  <rule id="5741" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection refused$</match>
+    <description>sshd: Connection refused (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5749 (level 4) → bad packet length : scanners/bots -->
+  <rule id="5749" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>^Bad packet length</match>
+    <description>sshd: Bad packet length (bruit de scan supprimé).</description>
+  </rule>
+
+  <!-- 5762 (level 4) → connection reset : doublon de 5740 -->
+  <rule id="5762" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection reset</match>
+    <description>sshd: Connection reset (bruit supprimé).</description>
+  </rule>
+
+</group>
+
+<!-- ─── IOC Suricata/Windows — parents exclus (0475, 0580, 0840) ──────────
+     IMPORTANT: <match>PLACEHOLDER_NEVER_MATCHES</match> au lieu de <match>.</match>
+     pour éviter que ces rules catch-all bloquent l'évaluation des rules avec
+     un ID plus élevé (first-match semantics dans Wazuh). -->
+<group name="ids,">
+  <rule id="99917" level="0" overwrite="yes">
+    <match>WAZUH_PLACEHOLDER_SURICATA_NEVER_MATCHES</match>
+    <description>Suricata: malicious domain — overwrite placeholder (non applicable).</description>
+  </rule>
+  <rule id="99918" level="0" overwrite="yes">
+    <match>WAZUH_PLACEHOLDER_SURICATA_DNS_NEVER_MATCHES</match>
+    <description>Suricata: malicious domain DNS — overwrite placeholder (non applicable).</description>
+  </rule>
+</group>
+
+<group name="windows,windows_security,">
+  <rule id="99919" level="0" overwrite="yes">
+    <match>WAZUH_PLACEHOLDER_WINDOWS_FAILED_NEVER_MATCHES</match>
+    <description>Windows: failed logon malicious IP — overwrite placeholder (non applicable).</description>
+  </rule>
+  <rule id="99920" level="0" overwrite="yes">
+    <match>WAZUH_PLACEHOLDER_WINDOWS_SUCCESS_NEVER_MATCHES</match>
+    <description>Windows: successful logon malicious IP — overwrite placeholder (non applicable).</description>
+  </rule>
+</group>
@@ -0,0 +1,352 @@
+<!-- ═══════════════════════════════════════════════════════════════════
+     ModSecurity OWASP Top 10 — Règles granulaires
+     ═══════════════════════════════════════════════════════════════════
+
+     Détection des attaques OWASP Top 10 via ModSecurity + active-response
+
+     Correspondances CRS (OWASP ModSec Core Rule Set) :
+     • 941xxx : XSS (Cross-Site Scripting)
+     • 942xxx : SQL Injection, LDAP Injection
+     • 943xxx : XXE (XML External Entity)
+     • 930xxx : Path Traversal, RFI (Remote File Inclusion)
+     • 932xxx : Remote Command Execution
+     • 933xxx : PHP Injection
+     • 934xxx : Java Injection
+     • 950xxx : Exploit attempts
+     • 951xxx : Regex DoS
+     • 952xxx : Restricted File Access
+     • 953xxx : Insecure File Upload
+     • 954xxx : Proxy Abuse
+     • 955xxx : Malicious HTTP Headers
+     • 970xxx : SSRF / Open Redirect
+-->
+
+<group name="web,modsecurity,owasp,">
+
+  <!-- ═══════════════════════════════════════════════════════════
+       RÈGLES BLOQUÉES (100102 - HTTP 403)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #3 : INJECTION (SQLi, Command Injection, LDAP, etc.)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- SQL Injection BLOQUÉE (942xx) -->
+  <rule id="100220" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">942[0-9]</field>
+    <description>OWASP#3 SQL Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,sql_injection,</group>
+  </rule>
+
+  <!-- LDAP Injection (942xx - LDAP patterns) -->
+  <rule id="100221" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">942[0-9].*LDAP\|ldap_filter</field>
+    <description>OWASP#3 LDAP Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,ldap_injection,</group>
+  </rule>
+
+  <!-- Command Injection / OS Command Execution (932xx) -->
+  <rule id="100222" level="14">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">932[0-9]</field>
+    <description>OWASP#3 Remote Command Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,command_injection,rce,</group>
+  </rule>
+
+  <!-- PHP Injection (933xx) -->
+  <rule id="100223" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">933[0-9]</field>
+    <description>OWASP#3 PHP Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,php_injection,</group>
+  </rule>
+
+  <!-- Java Injection (934xx) -->
+  <rule id="100224" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">934[0-9]</field>
+    <description>OWASP#3 Java Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,java_injection,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #6 : VULNERABLE & OUTDATED COMPONENTS (Exploit attempts)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- Remote Code Execution attempts (930xx, 950xx) -->
+  <rule id="100230" level="14">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">930[0-9]\|950[0-9]</field>
+    <description>OWASP#6 RCE / Exploit attempt bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_vulnerable_components,rce,exploit,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #7 : AUTHENTICATION & SESSION (XSS/CSRF/Session Theft)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- Cross-Site Scripting (941xx) -->
+  <rule id="100240" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">941[0-9]</field>
+    <description>OWASP#7 XSS attack bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_auth,xss,session_theft,</group>
+  </rule>
+
+  <!-- HTTP Response Splitting / Header Injection (955xx) -->
+  <rule id="100241" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">955[0-9]</field>
+    <description>OWASP#7 HTTP Header Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_auth,header_injection,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #1 : BROKEN ACCESS CONTROL (Path Traversal, Bypass)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- Path Traversal / Local File Inclusion (930xx - LFI patterns) -->
+  <rule id="100250" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">930[0-9].*\(path\|traversal\|lfi\)</field>
+    <description>OWASP#1 Path Traversal / LFI bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,lfi,path_traversal,</group>
+  </rule>
+
+  <!-- Remote File Inclusion (930xx - RFI patterns) -->
+  <rule id="100251" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">930[0-9].*\(rfi\|remote\|include\)</field>
+    <description>OWASP#1 Remote File Inclusion bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,rfi,</group>
+  </rule>
+
+  <!-- Restricted File Access (952xx) -->
+  <rule id="100252" level="11">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">952[0-9]</field>
+    <description>OWASP#1 Unauthorized File Access bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,file_access,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #8 : SOFTWARE & DATA INTEGRITY (XXE, Deserialization)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- XML External Entity (XXE) (943xx) -->
+  <rule id="100260" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">943[0-9]</field>
+    <description>OWASP#8 XML External Entity (XXE) bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_data_integrity,xxe,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       OWASP #9 : LOGGING & MONITORING FAILURES (Scanner Detection)
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- Web Application Scanner Detection (951xx, 954xx) -->
+  <rule id="100270" level="10">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">951[0-9]\|954[0-9]</field>
+    <description>OWASP#9 Web Scanner / Bot detected — $(transaction.client_ip)</description>
+    <group>owasp_monitoring,scanner_detection,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       AUTRES : SSRF, Open Redirect, Malicious File Upload
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- Server-Side Request Forgery (970xx, 971xx) -->
+  <rule id="100280" level="13">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">970[0-9]\|971[0-9]</field>
+    <description>OWASP Server-Side Request Forgery (SSRF) bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_misc,ssrf,</group>
+  </rule>
+
+  <!-- Insecure File Upload (953xx) -->
+  <rule id="100281" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">953[0-9]</field>
+    <description>OWASP Insecure File Upload bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_misc,file_upload,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       FRÉQUENCE & PATTERNS RÉPÉTÉS
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- SQLi répétées (brute-force injection) -->
+  <rule id="100290" level="14" frequency="3" timeframe="60">
+    <if_matched_sid>100220</if_matched_sid>
+    <description>OWASP#3 SQL Injection brute-force — $(transaction.client_ip) tentatives répétées</description>
+    <group>owasp_injection,sql_injection,brute_force,</group>
+  </rule>
+
+  <!-- XSS répétées (scanner ou attaque soutenue) -->
+  <rule id="100291" level="13" frequency="5" timeframe="120">
+    <if_matched_sid>100240</if_matched_sid>
+    <description>OWASP#7 XSS attack pattern — $(transaction.client_ip) attaque soutenue</description>
+    <group>owasp_auth,xss,</group>
+  </rule>
+
+  <!-- RCE attempts répétées (critiques) -->
+  <rule id="100292" level="15" frequency="2" timeframe="60">
+    <if_matched_sid>100222</if_matched_sid>
+    <description>OWASP#3 Command Injection attempts — $(transaction.client_ip) CRITICAL</description>
+    <group>owasp_injection,command_injection,critical,</group>
+  </rule>
+
+  <!-- Path Traversal brute-force -->
+  <rule id="100293" level="12" frequency="4" timeframe="180">
+    <if_matched_sid>100250</if_matched_sid>
+    <description>OWASP#1 Path Traversal brute-force — $(transaction.client_ip)</description>
+    <group>owasp_access_control,lfi,brute_force,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       RÈGLES REMONTÉES (100100 - tous les events, bloqués ou non)
+       Patterns OWASP détectés sans être bloqués
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- OWASP#3 SQLi remontée (942xx - non bloquée, anomaly scoring) -->
+  <rule id="100320" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">942[0-9]</field>
+    <description>OWASP#3 SQL Injection attempt (anomaly scoring) — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,sql_injection,warning,</group>
+  </rule>
+
+  <!-- OWASP#3 Command Injection remontée (932xx - non bloquée) -->
+  <rule id="100321" level="10">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">932[0-9]</field>
+    <description>OWASP#3 Command Injection attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,command_injection,warning,</group>
+  </rule>
+
+  <!-- OWASP#3 LDAP Injection remontée (942xx LDAP) -->
+  <rule id="100322" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">942[0-9].*LDAP\|ldap_filter</field>
+    <description>OWASP#3 LDAP Injection attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,ldap_injection,warning,</group>
+  </rule>
+
+  <!-- OWASP#3 PHP/Java Injection remontée (933xx, 934xx) -->
+  <rule id="100323" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">933[0-9]\|934[0-9]</field>
+    <description>OWASP#3 Code Injection attempt (PHP/Java) — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_injection,code_injection,warning,</group>
+  </rule>
+
+  <!-- OWASP#6 RCE/Exploit remontée (930xx, 950xx - non bloquée) -->
+  <rule id="100330" level="11">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">930[0-9]\|950[0-9]</field>
+    <description>OWASP#6 RCE / Exploit attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_vulnerable_components,rce,warning,</group>
+  </rule>
+
+  <!-- OWASP#7 XSS remontée (941xx - non bloquée) -->
+  <rule id="100340" level="8">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">941[0-9]</field>
+    <description>OWASP#7 XSS attempt (anomaly scoring) — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_auth,xss,warning,</group>
+  </rule>
+
+  <!-- OWASP#7 Header Injection remontée (955xx) -->
+  <rule id="100341" level="8">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">955[0-9]</field>
+    <description>OWASP#7 HTTP Header Injection attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_auth,header_injection,warning,</group>
+  </rule>
+
+  <!-- OWASP#1 Path Traversal remontée (930xx LFI patterns) -->
+  <rule id="100350" level="8">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">930[0-9].*\(path\|traversal\|lfi\)</field>
+    <description>OWASP#1 Path Traversal attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,lfi,warning,</group>
+  </rule>
+
+  <!-- OWASP#1 RFI remontée (930xx RFI patterns) -->
+  <rule id="100351" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">930[0-9].*\(rfi\|remote\|include\)</field>
+    <description>OWASP#1 Remote File Inclusion attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,rfi,warning,</group>
+  </rule>
+
+  <!-- OWASP#1 File Access remontée (952xx) -->
+  <rule id="100352" level="8">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">952[0-9]</field>
+    <description>OWASP#1 Unauthorized File Access attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_access_control,file_access,warning,</group>
+  </rule>
+
+  <!-- OWASP#8 XXE remontée (943xx) -->
+  <rule id="100360" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">943[0-9]</field>
+    <description>OWASP#8 XML External Entity (XXE) attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_data_integrity,xxe,warning,</group>
+  </rule>
+
+  <!-- OWASP#9 Scanner remontée (951xx, 954xx) -->
+  <rule id="100370" level="6">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">951[0-9]\|954[0-9]</field>
+    <description>OWASP#9 Web Scanner / Bot detected — $(transaction.client_ip)</description>
+    <group>owasp_monitoring,scanner_detection,warning,</group>
+  </rule>
+
+  <!-- OWASP SSRF remontée (970xx, 971xx) -->
+  <rule id="100380" level="9">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">970[0-9]\|971[0-9]</field>
+    <description>OWASP Server-Side Request Forgery (SSRF) attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_misc,ssrf,warning,</group>
+  </rule>
+
+  <!-- OWASP File Upload remontée (953xx) -->
+  <rule id="100381" level="8">
+    <if_sid>100100</if_sid>
+    <field name="transaction.messages.message">953[0-9]</field>
+    <description>OWASP Insecure File Upload attempt — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>owasp_misc,file_upload,warning,</group>
+  </rule>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       FRÉQUENCE — Attaques par anomaly scoring répétées
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- SQLi anomaly scoring répétée -->
+  <rule id="100394" level="10" frequency="5" timeframe="300">
+    <if_matched_sid>100320</if_matched_sid>
+    <description>OWASP#3 SQL Injection anomaly scoring — $(transaction.client_ip) tentatives répétées</description>
+    <group>owasp_injection,sql_injection,anomaly,</group>
+  </rule>
+
+  <!-- XSS anomaly scoring répétée -->
+  <rule id="100395" level="10" frequency="8" timeframe="300">
+    <if_matched_sid>100340</if_matched_sid>
+    <description>OWASP#7 XSS anomaly scoring — $(transaction.client_ip) attaque soutenue</description>
+    <group>owasp_auth,xss,anomaly,</group>
+  </rule>
+
+  <!-- Command Injection tentatives répétées -->
+  <rule id="100396" level="12" frequency="2" timeframe="60">
+    <if_matched_sid>100321</if_matched_sid>
+    <description>OWASP#3 Command Injection attempts — $(transaction.client_ip) CRITICAL</description>
+    <group>owasp_injection,command_injection,anomaly,</group>
+  </rule>
+
+</group>
@@ -0,0 +1,44 @@
+<group name="web,modsecurity,attack,">
+
+  <!-- Règles spécialisées par type d'attaque — basées sur local_modsecurity_rules.xml (rule 100102) -->
+
+  <!-- SQL Injection bloquée -->
+  <rule id="100202" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">SQL Injection\|SQLi\|942[0-9]</field>
+    <description>ModSecurity: SQL Injection bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>modsecurity_sqli,sql_injection,</group>
+  </rule>
+
+  <!-- XSS bloqué -->
+  <rule id="100203" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">XSS\|941[0-9]</field>
+    <description>ModSecurity: XSS bloqué — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>modsecurity_xss,xss,</group>
+  </rule>
+
+  <!-- Remote Code Execution bloqué -->
+  <rule id="100204" level="14">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">RCE\|930[0-9]\|932[0-9]</field>
+    <description>ModSecurity: tentative RCE bloquée — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>modsecurity_rce,rce,</group>
+  </rule>
+
+  <!-- Local File Inclusion bloqué -->
+  <rule id="100205" level="12">
+    <if_sid>100102</if_sid>
+    <field name="transaction.messages.message">LFI\|930[0-9]</field>
+    <description>ModSecurity: LFI bloqué — $(transaction.client_ip) → $(transaction.request.uri)</description>
+    <group>modsecurity_lfi,lfi,</group>
+  </rule>
+
+  <!-- Blocages répétés — attaque soutenue -->
+  <rule id="100210" level="14" frequency="5" timeframe="120">
+    <if_matched_sid>100102</if_matched_sid>
+    <description>ModSecurity: blocages répétés en 2 min — attaque soutenue</description>
+    <group>modsecurity_repeated,</group>
+  </rule>
+
+</group>