chore: update wazuh

monitoring/security/wazuh/create-dashboard-vpn.py

@@ -29,10 +29,20 @@ DASHBOARD_PASS = os.environ.get("DASHBOARD_PASSWORD", "E9Jpr6586kQ3wYrCS2!")
 INDEX_PATTERN  = "wazuh-alerts-*"
 
 # ── Queries ────────────────────────────────────────────────────────────────────
-Q_ALL        = "rule.id: 100801 OR rule.id: 100802 OR rule.id: 100803 OR rule.id: 100810 OR rule.id: 100811 OR rule.id: 100812 OR rule.id: 100815"
-Q_HANDSHAKES = "rule.id: 100801 OR rule.id: 100802 OR rule.id: 100803"
+# Note: pour un peer de la liste de confiance (etc/lists/wireguard-trusted-ips),
+# analysisd indexe l'alerte sous le rule.id de la regle enfant 1082x (voir
+# wireguard-rules.xml), pas celui du parent 1008xx. Il faut donc inclure les
+# deux jeux d'IDs partout, sinon les peers de confiance disparaissent des stats.
+Q_ALL        = ("rule.id: 100801 OR rule.id: 100802 OR rule.id: 100803 OR rule.id: 100810 "
+                "OR rule.id: 100811 OR rule.id: 100812 OR rule.id: 100815 OR rule.id: 100816 "
+                "OR rule.id: 100821 OR rule.id: 100822 OR rule.id: 100823 OR rule.id: 100825 OR rule.id: 100826")
+Q_HANDSHAKES = ("rule.id: 100801 OR rule.id: 100802 OR rule.id: 100803 "
+                "OR rule.id: 100821 OR rule.id: 100822 OR rule.id: 100823")
 Q_WARNINGS   = "rule.id: 100810 OR rule.id: 100811 OR rule.id: 100812"
-Q_COMPLETE   = "rule.id: 100803"
+# Peers actifs : cardinalite sur data.srcip, tous rule.id de handshake confondus
+# (100802/100822 = reponse envoyee, le cas dominant sur un serveur qui recoit les
+# connexions ; 100803/100823 = reponse recue, cote initiateur).
+Q_COMPLETE   = Q_HANDSHAKES
 
 # ── Client HTTP ────────────────────────────────────────────────────────────────
 ctx = ssl.create_default_context()
@@ -337,7 +347,9 @@ def main():
             "description": "Handshakes peers, deconnexions, timeouts, activite par IP — agent vpn-prod",
             "panelsJSON": json.dumps(PANELS),
             "optionsJSON": json.dumps({"useMargins": True, "hidePanelTitles": False}),
-            "timeRestore": False,
+            "timeRestore": True,
+            "timeFrom": "now-24h",
+            "timeTo": "now",
             "kibanaSavedObjectMeta": {
                 "searchSourceJSON": json.dumps({"query": {"language": "kuery", "query": ""}, "filter": []})
             },