From adf00cf3d0c58773c767578f48f377ba8bb8505f Mon Sep 17 00:00:00 2001
From: Nuxgrid <xor_fakers@AsusXor.localdomain>
Date: Sat, 18 Jul 2026 22:30:24 +0200
Subject: [PATCH] chore: update

---
 .../wazuh/config/wazuh_manager/init.sh        |  3 +-
 .../wazuh/config/wazuh_manager/ossec.conf     |  1 +
 .../wazuh_manager/rules/wireguard-rules.xml   | 47 +++++++++++++++++--
 3 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/monitoring/security/wazuh/config/wazuh_manager/init.sh b/monitoring/security/wazuh/config/wazuh_manager/init.sh
index bdd686a5..7ce9742e 100755
--- a/monitoring/security/wazuh/config/wazuh_manager/init.sh
+++ b/monitoring/security/wazuh/config/wazuh_manager/init.sh
@@ -6,9 +6,10 @@ CUSTOM=/wazuh-custom
 
 cp "$CUSTOM/ossec.conf" /var/ossec/etc/ossec.conf
 
-mkdir -p /var/ossec/etc/decoders /var/ossec/etc/rules
+mkdir -p /var/ossec/etc/decoders /var/ossec/etc/rules /var/ossec/etc/lists
 cp "$CUSTOM/decoders/"*.xml /var/ossec/etc/decoders/ 2>/dev/null || true
 cp "$CUSTOM/rules/"*.xml    /var/ossec/etc/rules/    2>/dev/null || true
+cp "$CUSTOM/lists/"*        /var/ossec/etc/lists/    2>/dev/null || true
 
 # ─── Agent config partagée (distribuée aux agents) ───────────────────────────
 if [ -f "$CUSTOM/agent.conf" ]; then
diff --git a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
index 7e7c38a2..8b4037b6 100755
--- a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
+++ b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
@@ -1012,6 +1012,7 @@
     <list>etc/lists/malicious-ioc/malicious-ip</list>
     <list>etc/lists/malicious-ioc/malicious-domains</list>
     <list>etc/lists/malicious-ioc/malware-hashes</list>
+    <list>etc/lists/wireguard-trusted-ips</list>
     <!-- Exclusion du decoder natif aws-eks-authenticator : son prematch pcre2
          time="\d{4}-\d{2}-\d{2}T..." capture aussi les logs logrus CrowdSec,
          empechant notre decoder crowdsec-ban d'extraire data.srcip. -->
diff --git a/monitoring/security/wazuh/config/wazuh_manager/rules/wireguard-rules.xml b/monitoring/security/wazuh/config/wazuh_manager/rules/wireguard-rules.xml
index 2a922bff..5d317f89 100644
--- a/monitoring/security/wazuh/config/wazuh_manager/rules/wireguard-rules.xml
+++ b/monitoring/security/wazuh/config/wazuh_manager/rules/wireguard-rules.xml
@@ -1,6 +1,11 @@
-<!-- Règles WireGuard VPN — IDs 100800-100816
+<!-- Règles WireGuard VPN — IDs 100800-100826
      Les logs kernel passent par rule 5100 (program_name=^kernel).
-     On hérite via if_sid 5100 et on filtre par match/regex. -->
+     On hérite via if_sid 5100 et on filtre par match/regex.
+     Les rules 1082x sont des enfants qui redescendent le niveau à 0
+     pour les peers de confiance (etc/lists/wireguard-trusted-ips) :
+     le negate="yes" sur <list> n'est pas supporté par analysisd ici,
+     donc on matche positivement et on laisse la règle la plus
+     spécifique (l'enfant) l'emporter sur le parent. -->
 
 <group name="wireguard,vpn,">
 
@@ -21,6 +26,13 @@
     <group>wireguard,vpn_handshake,</group>
   </rule>
 
+  <rule id="100821" level="0">
+    <if_sid>100801</if_sid>
+    <list field="srcip" lookup="match_key">etc/lists/wireguard-trusted-ips</list>
+    <description>WireGuard: handshake initiation - peer de confiance $(srcip)</description>
+    <group>wireguard,vpn_handshake,vpn_trusted,</group>
+  </rule>
+
   <!-- Handshake réponse envoyée -->
   <rule id="100802" level="3">
     <if_sid>5100</if_sid>
@@ -29,6 +41,13 @@
     <group>wireguard,vpn_handshake,</group>
   </rule>
 
+  <rule id="100822" level="0">
+    <if_sid>100802</if_sid>
+    <list field="srcip" lookup="match_key">etc/lists/wireguard-trusted-ips</list>
+    <description>WireGuard: handshake reponse - peer de confiance $(srcip)</description>
+    <group>wireguard,vpn_handshake,vpn_trusted,</group>
+  </rule>
+
   <!-- Handshake réponse reçue (session établie) -->
   <rule id="100803" level="3">
     <if_sid>5100</if_sid>
@@ -37,7 +56,15 @@
     <group>wireguard,vpn_handshake,</group>
   </rule>
 
-  <!-- Handshake timeout -->
+  <rule id="100823" level="0">
+    <if_sid>100803</if_sid>
+    <list field="srcip" lookup="match_key">etc/lists/wireguard-trusted-ips</list>
+    <description>WireGuard: handshake complet - peer de confiance $(srcip)</description>
+    <group>wireguard,vpn_handshake,vpn_trusted,</group>
+  </rule>
+
+  <!-- Handshake timeout (pas d'exclusion : un timeout reste un signal utile,
+       même pour un peer de confiance) -->
   <rule id="100810" level="7">
     <if_sid>5100</if_sid>
     <match>wireguard: wg0: Handshake for peer</match>
@@ -71,6 +98,13 @@
     <group>wireguard,vpn_roaming,</group>
   </rule>
 
+  <rule id="100825" level="0">
+    <if_sid>100815</if_sid>
+    <list field="srcip" lookup="match_key">etc/lists/wireguard-trusted-ips</list>
+    <description>WireGuard: roaming - peer de confiance $(id) vers $(srcip)</description>
+    <group>wireguard,vpn_roaming,vpn_trusted,</group>
+  </rule>
+
   <!-- Reconnexion après déconnexion -->
   <rule id="100816" level="6">
     <if_sid>5100</if_sid>
@@ -79,4 +113,11 @@
     <group>wireguard,vpn_reconnected,</group>
   </rule>
 
+  <rule id="100826" level="0">
+    <if_sid>100816</if_sid>
+    <list field="srcip" lookup="match_key">etc/lists/wireguard-trusted-ips</list>
+    <description>WireGuard: reconnexion - peer de confiance $(srcip)</description>
+    <group>wireguard,vpn_reconnected,vpn_trusted,</group>
+  </rule>
+
 </group>