chore
This commit is contained in:
@@ -3,7 +3,7 @@
|
||||
|
||||
<agent_config>
|
||||
|
||||
<!-- ── Logs nginx (prod-uber et pre-prod-uber) ──────────────────── -->
|
||||
<!-- ── Logs nginx ──────────────────────────────────────────────────── -->
|
||||
<localfile>
|
||||
<log_format>apache</log_format>
|
||||
<location>/var/log/nginx/access.log</location>
|
||||
@@ -14,14 +14,6 @@
|
||||
<location>/var/log/nginx/error.log</location>
|
||||
</localfile>
|
||||
|
||||
<!-- ── Logs Docker backend Go (stdout container) ─────────────────── -->
|
||||
<!-- Le container s'appelle "backend" dans le compose prod -->
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/lib/docker/containers/*/*-json.log</location>
|
||||
<label key="container">backend</label>
|
||||
</localfile>
|
||||
|
||||
<!-- ── Auth system ───────────────────────────────────────────────── -->
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
@@ -35,4 +27,4 @@
|
||||
</localfile>
|
||||
|
||||
</agent_config>
|
||||
</content>
|
||||
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
<!-- Decoders API Backend Go (service systemd "backend") -->
|
||||
|
||||
<!-- Root : capture tous les logs du service systemd backend -->
|
||||
<decoder name="go-backend">
|
||||
<program_name>backend</program_name>
|
||||
</decoder>
|
||||
|
||||
<!-- Child : logs HTTP Gin — "[GIN] | 200 | 1.234ms | 1.2.3.4 | GET /api/..." -->
|
||||
<decoder name="go-backend-gin">
|
||||
<parent>go-backend</parent>
|
||||
<prematch>[GIN]</prematch>
|
||||
<regex type="pcre2">\|\s+(\d{3})\s+\|\s+(\S+)\s+\|\s+([\d.]+)\s+\|\s+(\S+)\s+(\S+)</regex>
|
||||
<order>id,extra_data,srcip,protocol,url</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Child : echecs auth login -->
|
||||
<decoder name="go-backend-login-fail">
|
||||
<parent>go-backend</parent>
|
||||
<prematch>LOGIN_ADMIN|LOGIN_CLIENT</prematch>
|
||||
<regex>LOGIN_\S+ \S+ \S+ \S+: (\S+)</regex>
|
||||
<order>srcuser</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Fallback root (logs non-systemd, ex: pre-prod Docker) -->
|
||||
<decoder name="go-backend-raw">
|
||||
<prematch>LOGIN_ADMIN|LOGIN_CLIENT</prematch>
|
||||
<regex>LOGIN_\S+ \S+ \S+ \S+: (\S+)</regex>
|
||||
<order>srcuser</order>
|
||||
</decoder>
|
||||
@@ -1,56 +1,45 @@
|
||||
<!-- WireGuard Decoders — logs kernel via journald
|
||||
Format: wireguard: wg0: <action> to/from peer N (IP:port) -->
|
||||
<!-- WireGuard Decoders
|
||||
Parent: kernel (built-in, program_name=^kernel)
|
||||
Decoders enfants directs de kernel (Wazuh: 2 niveaux max) -->
|
||||
|
||||
<!-- Root : messages kernel WireGuard (syslog program_name=kernel) -->
|
||||
<decoder name="wireguard">
|
||||
<program_name>kernel</program_name>
|
||||
<prematch>wireguard: wg0: </prematch>
|
||||
</decoder>
|
||||
|
||||
<!-- Initiation handshake : VPN server → peer -->
|
||||
<decoder name="wireguard-handshake-init">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>Sending handshake initiation</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: Sending handshake initiation</prematch>
|
||||
<regex type="pcre2">wireguard: wg0: Sending handshake initiation to peer (\d+) \(([\d.]+):\d+\)</regex>
|
||||
<order>id,srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Réponse handshake envoyée : VPN server → peer -->
|
||||
<decoder name="wireguard-handshake-resp-sent">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>Sending handshake response</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: Sending handshake response</prematch>
|
||||
<regex type="pcre2">wireguard: wg0: Sending handshake response to peer (\d+) \(([\d.]+):\d+\)</regex>
|
||||
<order>id,srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Réponse handshake reçue : peer → VPN server -->
|
||||
<decoder name="wireguard-handshake-resp-recv">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>Receiving handshake response</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: Receiving handshake response</prematch>
|
||||
<regex type="pcre2">wireguard: wg0: Receiving handshake response from peer (\d+) \(([\d.]+):\d+\)</regex>
|
||||
<order>id,srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Keepalive (niveau bas, pas d'alerte) -->
|
||||
<decoder name="wireguard-keepalive">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>keepalive packet</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: </prematch>
|
||||
<regex type="pcre2">wireguard: wg0: \S+ keepalive packet \S+ peer (\d+) \(([\d.]+):\d+\)</regex>
|
||||
<order>id,srcip</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Handshake timeout — "did not complete after 5 seconds, retrying (try N)" -->
|
||||
<decoder name="wireguard-timeout">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>did not complete</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: Handshake for peer</prematch>
|
||||
<regex type="pcre2">wireguard: wg0: Handshake for peer (\d+)[^(]+\(([\d.]+):\d+\).+retrying \(try (\d+)\)</regex>
|
||||
<order>id,srcip,extra_data</order>
|
||||
</decoder>
|
||||
|
||||
<!-- Peer roaming (changement d'IP source) -->
|
||||
<decoder name="wireguard-roaming">
|
||||
<parent>wireguard</parent>
|
||||
<prematch>is now roaming</prematch>
|
||||
<parent>kernel</parent>
|
||||
<prematch>wireguard: wg0: Peer </prematch>
|
||||
<regex type="pcre2">wireguard: wg0: Peer (\d+).+roaming to ([\d.]+):\d+</regex>
|
||||
<order>id,srcip</order>
|
||||
</decoder>
|
||||
|
||||
@@ -1,90 +0,0 @@
|
||||
<!-- Regles API Backend Go — IDs 100600-100720 -->
|
||||
|
||||
<!-- ── Logs backend systemd ───────────────────────────────────────────── -->
|
||||
<group name="api_backend,">
|
||||
|
||||
<!-- Catch-all : toute ligne du service backend (niveau 3 = indexe dans OpenSearch) -->
|
||||
<rule id="100700" level="3">
|
||||
<decoded_as>go-backend</decoded_as>
|
||||
<description>Go Backend API: log entry</description>
|
||||
<group>api_backend,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Log HTTP Gin : toute requete -->
|
||||
<rule id="100701" level="3">
|
||||
<if_sid>100700</if_sid>
|
||||
<match>[GIN]</match>
|
||||
<description>API: Requete HTTP Gin loggee</description>
|
||||
<group>api_backend,api_http,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Log HTTP Gin : erreur client 4xx — pattern "| 4NN |" -->
|
||||
<rule id="100702" level="5">
|
||||
<if_sid>100701</if_sid>
|
||||
<regex>| 4\d\d |</regex>
|
||||
<description>API: Erreur client 4xx — $(srcip)</description>
|
||||
<group>api_backend,api_http,api_error,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Log HTTP Gin : erreur serveur 5xx -->
|
||||
<rule id="100703" level="8">
|
||||
<if_sid>100701</if_sid>
|
||||
<regex>| 5\d\d |</regex>
|
||||
<description>API: Erreur serveur 5xx — $(srcip)</description>
|
||||
<group>api_backend,api_http,api_error,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Erreur Go (panic, fatal, error) -->
|
||||
<rule id="100704" level="9">
|
||||
<if_sid>100700</if_sid>
|
||||
<match>panic|PANIC|fatal|FATAL</match>
|
||||
<description>API: Erreur critique Go backend (panic/fatal)</description>
|
||||
<group>api_backend,api_error,</group>
|
||||
</rule>
|
||||
|
||||
</group>
|
||||
|
||||
<!-- ── Auth failures via logs Go backend ────────────────────────────── -->
|
||||
<group name="web,authentication_failures,api,">
|
||||
|
||||
<!-- Echec login admin (log Go direct) -->
|
||||
<rule id="100600" level="5">
|
||||
<decoded_as>go-backend-login-fail</decoded_as>
|
||||
<match>LOGIN_ADMIN</match>
|
||||
<description>API: Echec auth admin</description>
|
||||
<group>api_auth_failure,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Echec login client (log Go direct) -->
|
||||
<rule id="100601" level="5">
|
||||
<decoded_as>go-backend-login-fail</decoded_as>
|
||||
<match>LOGIN_CLIENT</match>
|
||||
<description>API: Echec auth client</description>
|
||||
<group>api_auth_failure,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Brute-force login admin : 5 echecs en 60s -->
|
||||
<rule id="100610" level="10" frequency="5" timeframe="60">
|
||||
<if_matched_sid>100600</if_matched_sid>
|
||||
<same_source_ip />
|
||||
<description>API: Brute-force login admin — 5 echecs/60s depuis $(srcip)</description>
|
||||
<group>api_brute_force,authentication_failures,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Brute-force login client : 5 echecs en 60s -->
|
||||
<rule id="100611" level="10" frequency="5" timeframe="60">
|
||||
<if_matched_sid>100601</if_matched_sid>
|
||||
<same_source_ip />
|
||||
<description>API: Brute-force login client — 5 echecs/60s depuis $(srcip)</description>
|
||||
<group>api_brute_force,authentication_failures,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Scan auth : 20 echecs en 120s toutes routes -->
|
||||
<rule id="100612" level="12" frequency="20" timeframe="120">
|
||||
<if_matched_group>api_auth_failure</if_matched_group>
|
||||
<same_source_ip />
|
||||
<description>API: Scan auth — 20 echecs/120s depuis $(srcip)</description>
|
||||
<group>api_brute_force,authentication_failures,</group>
|
||||
</rule>
|
||||
|
||||
</group>
|
||||
@@ -1,69 +1,81 @@
|
||||
<!-- Règles WireGuard VPN — IDs 100800-100820 -->
|
||||
<!-- Règles WireGuard VPN — IDs 100800-100816
|
||||
Les logs kernel passent par rule 5100 (program_name=^kernel).
|
||||
On hérite via if_sid 5100 et on filtre par match/regex. -->
|
||||
|
||||
<group name="wireguard,vpn,">
|
||||
|
||||
<!-- Keepalive : niveau 0 = pas d'index dans OpenSearch -->
|
||||
<!-- Keepalive : level 0 = pas d'index OpenSearch -->
|
||||
<rule id="100800" level="0">
|
||||
<decoded_as>wireguard-keepalive</decoded_as>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: </match>
|
||||
<regex>keepalive packet</regex>
|
||||
<description>WireGuard: keepalive peer $(srcip)</description>
|
||||
<group>wireguard,vpn_keepalive,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Handshake initiation (VPN server → peer) -->
|
||||
<!-- Handshake initiation -->
|
||||
<rule id="100801" level="3">
|
||||
<decoded_as>wireguard-handshake-init</decoded_as>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Sending handshake initiation</match>
|
||||
<description>WireGuard: handshake initiation vers peer $(srcip)</description>
|
||||
<group>wireguard,vpn_handshake,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Handshake réponse envoyée (VPN server → peer) -->
|
||||
<!-- Handshake réponse envoyée -->
|
||||
<rule id="100802" level="3">
|
||||
<decoded_as>wireguard-handshake-resp-sent</decoded_as>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Sending handshake response</match>
|
||||
<description>WireGuard: handshake reponse envoyee a peer $(srcip)</description>
|
||||
<group>wireguard,vpn_handshake,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Handshake réponse reçue (peer → VPN server) -->
|
||||
<!-- Handshake réponse reçue (session établie) -->
|
||||
<rule id="100803" level="3">
|
||||
<decoded_as>wireguard-handshake-resp-recv</decoded_as>
|
||||
<description>WireGuard: handshake complete avec peer $(srcip)</description>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Receiving handshake response</match>
|
||||
<description>WireGuard: handshake complet avec peer $(srcip)</description>
|
||||
<group>wireguard,vpn_handshake,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Timeout handshake (premier retry) -->
|
||||
<!-- Handshake timeout -->
|
||||
<rule id="100810" level="7">
|
||||
<decoded_as>wireguard-timeout</decoded_as>
|
||||
<description>WireGuard: handshake timeout peer $(srcip) (essai $(extra_data))</description>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Handshake for peer</match>
|
||||
<regex>did not complete</regex>
|
||||
<description>WireGuard: handshake timeout peer $(srcip)</description>
|
||||
<group>wireguard,vpn_warning,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Timeout répété — peer probablement déconnecté (try >= 5) -->
|
||||
<!-- Timeout répété >= 5 -->
|
||||
<rule id="100811" level="10">
|
||||
<if_sid>100810</if_sid>
|
||||
<match>try 5|try 6|try 7|try 8|try 9</match>
|
||||
<description>WireGuard: peer $(srcip) deconnecte — handshake echoue 5 fois consecutives</description>
|
||||
<description>WireGuard: peer $(srcip) deconnecte</description>
|
||||
<group>wireguard,vpn_disconnected,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Timeout grave — try 10+ -->
|
||||
<!-- Timeout grave >= 10 -->
|
||||
<rule id="100812" level="12">
|
||||
<if_sid>100810</if_sid>
|
||||
<regex>retrying \(try 1\d\)</regex>
|
||||
<description>WireGuard: peer $(srcip) hors ligne depuis plus de 60 secondes</description>
|
||||
<regex>retrying .try 1\d.</regex>
|
||||
<description>WireGuard: peer $(srcip) hors ligne depuis plus de 60s</description>
|
||||
<group>wireguard,vpn_disconnected,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Peer roaming (changement d'IP publique) -->
|
||||
<!-- Peer roaming -->
|
||||
<rule id="100815" level="5">
|
||||
<decoded_as>wireguard-roaming</decoded_as>
|
||||
<description>WireGuard: peer $(id) a change d'IP (roaming) vers $(srcip)</description>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Peer </match>
|
||||
<regex>is now roaming</regex>
|
||||
<description>WireGuard: peer $(id) roaming vers $(srcip)</description>
|
||||
<group>wireguard,vpn_roaming,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Peer reconnecté (handshake complet) -->
|
||||
<!-- Reconnexion après déconnexion -->
|
||||
<rule id="100816" level="6">
|
||||
<decoded_as>wireguard-handshake-resp-recv</decoded_as>
|
||||
<description>WireGuard: peer $(srcip) handshake complet (reconnexion possible)</description>
|
||||
<if_sid>5100</if_sid>
|
||||
<match>wireguard: wg0: Receiving handshake response</match>
|
||||
<description>WireGuard: peer $(srcip) reconnecte</description>
|
||||
<group>wireguard,vpn_reconnected,</group>
|
||||
</rule>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user