diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml
index 8639c5b5..e113d3d6 100644
--- a/monitoring/docker-compose.yml
+++ b/monitoring/docker-compose.yml
@@ -59,7 +59,9 @@ services:
             - SSL_KEY=/etc/ssl/filebeat.key
             - API_USERNAME=wazuh-wui
             - API_PASSWORD=${WAZUH_API_PASSWORD}
+        entrypoint: ["/bin/bash", "/wazuh-custom/init.sh"]
         volumes:
+            - ./wazuh/config/wazuh_manager/:/wazuh-custom/:ro
             - wazuh_api_configuration:/var/ossec/api/configuration
             - wazuh_etc:/var/ossec/etc
             - wazuh_logs:/var/ossec/logs
diff --git a/monitoring/wazuh/config/wazuh_manager/decoders/modsecurity_decoder.xml b/monitoring/wazuh/config/wazuh_manager/decoders/modsecurity_decoder.xml
new file mode 100644
index 00000000..8685a477
--- /dev/null
+++ b/monitoring/wazuh/config/wazuh_manager/decoders/modsecurity_decoder.xml
@@ -0,0 +1,29 @@
+<!-- ═══════════════════════════════════════════════════════════════
+     Decoders ModSecurity (nginx error.log)
+     Format attendu :
+       [client IP:PORT] ModSecurity: Access denied with code 403
+         (phase 2). Message [id "XXXXX"] [msg "..."] [uri "..."]
+       [client IP:PORT] ModSecurity: Warning. ... [id "XXXXX"]
+         [msg "..."] [uri "..."]
+     ═══════════════════════════════════════════════════════════════ -->
+
+<!-- Decoder parent : identifie toute ligne ModSecurity -->
+<decoder name="modsecurity">
+  <prematch>ModSecurity: </prematch>
+</decoder>
+
+<!-- Decoder enfant : Access denied (requête bloquée) -->
+<decoder name="modsecurity-block">
+  <parent>modsecurity</parent>
+  <prematch>ModSecurity: Access denied</prematch>
+  <regex>\[client (\d+\.\d+\.\d+\.\d+):\p+\] ModSecurity: Access denied with code (\d+) \(phase \d+\)\.\s*(\S[^[]*?)\s*\[id "(\d+)"\][^\[]*\[msg "([^"]+)"\][^\[]*\[uri "([^"]+)"\]</regex>
+  <order>srcip,status,extra_data,id,extra_data2,url</order>
+</decoder>
+
+<!-- Decoder enfant : Warning (règle matchée sans blocage) -->
+<decoder name="modsecurity-warning">
+  <parent>modsecurity</parent>
+  <prematch>ModSecurity: Warning</prematch>
+  <regex>\[client (\d+\.\d+\.\d+\.\d+):\p+\] ModSecurity: Warning\.[^\[]*\[id "(\d+)"\][^\[]*\[msg "([^"]+)"\][^\[]*\[uri "([^"]+)"\]</regex>
+  <order>srcip,id,extra_data,url</order>
+</decoder>
diff --git a/monitoring/wazuh/config/wazuh_manager/init.sh b/monitoring/wazuh/config/wazuh_manager/init.sh
new file mode 100644
index 00000000..25ecb054
--- /dev/null
+++ b/monitoring/wazuh/config/wazuh_manager/init.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -e
+
+# ─── Copie de la config custom (montée hors du volume wazuh_etc) ──────────────
+CUSTOM=/wazuh-custom
+
+cp "$CUSTOM/ossec.conf" /var/ossec/etc/ossec.conf
+
+mkdir -p /var/ossec/etc/decoders /var/ossec/etc/rules
+cp "$CUSTOM/decoders/"*.xml /var/ossec/etc/decoders/ 2>/dev/null || true
+cp "$CUSTOM/rules/"*.xml    /var/ossec/etc/rules/    2>/dev/null || true
+
+# ─── Démarrage Wazuh Manager (entrypoint original) ────────────────────────────
+exec /init
diff --git a/monitoring/wazuh/config/wazuh_manager/ossec.conf b/monitoring/wazuh/config/wazuh_manager/ossec.conf
new file mode 100644
index 00000000..cf206535
--- /dev/null
+++ b/monitoring/wazuh/config/wazuh_manager/ossec.conf
@@ -0,0 +1,579 @@
+<ossec_config>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       GLOBAL
+       ═══════════════════════════════════════════════════════════ -->
+  <global>
+    <jsonout_output>yes</jsonout_output>
+    <alerts_log>yes</alerts_log>
+    <logall>no</logall>
+    <logall_json>no</logall_json>
+    <email_notification>no</email_notification>
+    <agents_disconnection_time>10m</agents_disconnection_time>
+    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
+  </global>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       ALERTES
+       ═══════════════════════════════════════════════════════════ -->
+  <alerts>
+    <log_alert_level>3</log_alert_level>
+  </alerts>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       LOGGING
+       ═══════════════════════════════════════════════════════════ -->
+  <logging>
+    <log_format>plain</log_format>
+  </logging>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       COMMUNICATION AGENTS (port 1514 TCP)
+       ═══════════════════════════════════════════════════════════ -->
+  <remote>
+    <connection>secure</connection>
+    <port>1514</port>
+    <protocol>tcp</protocol>
+    <queue_size>131072</queue_size>
+  </remote>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       POLICY MONITORING
+       ═══════════════════════════════════════════════════════════ -->
+  <rootcheck>
+    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
+    <check_dev>yes</check_dev>
+    <check_sys>yes</check_sys>
+    <check_pids>yes</check_pids>
+    <check_ports>yes</check_ports>
+    <check_if>yes</check_if>
+    <frequency>43200</frequency>
+    <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
+    <skip_nfs>yes</skip_nfs>
+  </rootcheck>
+
+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       SYSTEM INVENTORY
+       ═══════════════════════════════════════════════════════════ -->
+  <wodle name="syscollector">
+    <disabled>no</disabled>
+    <interval>1h</interval>
+    <scan_on_start>yes</scan_on_start>
+    <hardware>yes</hardware>
+    <os>yes</os>
+    <network>yes</network>
+    <packages>yes</packages>
+    <ports all="yes">yes</ports>
+    <processes>yes</processes>
+    <synchronization>
+      <max_eps>10</max_eps>
+    </synchronization>
+  </wodle>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       SECURITY CONFIGURATION ASSESSMENT
+       ═══════════════════════════════════════════════════════════ -->
+  <sca>
+    <enabled>yes</enabled>
+    <scan_on_start>yes</scan_on_start>
+    <interval>12h</interval>
+    <skip_nfs>yes</skip_nfs>
+  </sca>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       VULNERABILITY DETECTION
+       ═══════════════════════════════════════════════════════════ -->
+  <vulnerability-detection>
+    <enabled>yes</enabled>
+    <index-status>yes</index-status>
+    <feed-update-interval>60m</feed-update-interval>
+  </vulnerability-detection>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       INDEXER (Wazuh Indexer / OpenSearch)
+       ═══════════════════════════════════════════════════════════ -->
+  <indexer>
+    <enabled>yes</enabled>
+    <hosts>
+      <host>https://wazuh.indexer:9200</host>
+    </hosts>
+    <ssl>
+      <certificate_authorities>
+        <ca>/etc/ssl/root-ca.pem</ca>
+      </certificate_authorities>
+      <certificate>/etc/ssl/filebeat.pem</certificate>
+      <key>/etc/ssl/filebeat.key</key>
+    </ssl>
+  </indexer>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       FILE INTEGRITY MONITORING
+       ═══════════════════════════════════════════════════════════ -->
+  <syscheck>
+    <disabled>no</disabled>
+    <frequency>43200</frequency>
+    <scan_on_start>yes</scan_on_start>
+    <alert_new_files>yes</alert_new_files>
+    <auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
+    <directories>/etc,/usr/bin,/usr/sbin</directories>
+    <directories>/bin,/sbin,/boot</directories>
+    <ignore>/etc/mtab</ignore>
+    <ignore>/etc/hosts.deny</ignore>
+    <ignore>/etc/mail/statistics</ignore>
+    <ignore>/etc/random-seed</ignore>
+    <ignore>/etc/random.seed</ignore>
+    <ignore>/etc/adjtime</ignore>
+    <ignore>/etc/httpd/logs</ignore>
+    <ignore>/etc/utmpx</ignore>
+    <ignore>/etc/wtmpx</ignore>
+    <ignore>/etc/cups/certs</ignore>
+    <ignore>/etc/dumpdates</ignore>
+    <ignore>/etc/svc/volatile</ignore>
+    <ignore type="sregex">.log$|.swp$</ignore>
+    <nodiff>/etc/ssl/private.key</nodiff>
+    <skip_nfs>yes</skip_nfs>
+    <skip_dev>yes</skip_dev>
+    <skip_proc>yes</skip_proc>
+    <skip_sys>yes</skip_sys>
+    <process_priority>10</process_priority>
+    <max_eps>100</max_eps>
+    <synchronization>
+      <enabled>yes</enabled>
+      <interval>5m</interval>
+      <max_interval>1h</max_interval>
+      <max_eps>10</max_eps>
+    </synchronization>
+  </syscheck>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       ACTIVE RESPONSE — WHITELIST
+       90.50.148.138 : IP publique admin — jamais bloquée
+       ═══════════════════════════════════════════════════════════ -->
+  <global>
+    <white_list>127.0.0.1</white_list>
+    <white_list>^localhost.localdomain$</white_list>
+    <white_list>90.50.148.138</white_list>
+  </global>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       ACTIVE RESPONSE — COMMANDES
+       ═══════════════════════════════════════════════════════════ -->
+  <command>
+    <name>disable-account</name>
+    <executable>disable-account</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>restart-wazuh</name>
+    <executable>restart-wazuh</executable>
+  </command>
+
+  <command>
+    <name>firewall-drop</name>
+    <executable>firewall-drop</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>host-deny</name>
+    <executable>host-deny</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>route-null</name>
+    <executable>route-null</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>win_route-null</name>
+    <executable>route-null.exe</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <command>
+    <name>netsh</name>
+    <executable>netsh.exe</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       ACTIVE RESPONSE — RÈGLES
+       ═══════════════════════════════════════════════════════════ -->
+
+  <!-- SSH mauvais mot de passe → ban PERMANENT (1 tentative suffit) -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_group>authentication_failures</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Échec auth générique → ban PERMANENT -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_group>authentication_failed</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
+  <active-response>
+    <command>host-deny</command>
+    <location>local</location>
+    <rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <level>7</level>
+    <rules_group>web,attack</rules_group>
+    <timeout>300</timeout>
+  </active-response>
+
+  <!-- Scan de ports → firewall-drop 1 heure -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_id>1002,2502,2503,2504</rules_id>
+    <timeout>3600</timeout>
+  </active-response>
+
+  <!-- SSH brute-force → host-deny PERMANENT (double protection) -->
+  <active-response>
+    <command>host-deny</command>
+    <location>local</location>
+    <rules_group>authentication_failures,authentication_failed</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_id>100202,100203,100205</rules_id>
+    <timeout>21600</timeout>
+  </active-response>
+
+  <!-- ModSecurity RCE / anomalie critique → firewall-drop 24 heures -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_id>100204,100206</rules_id>
+    <timeout>86400</timeout>
+  </active-response>
+
+  <!-- Attaque soutenue ModSec (5 blocs / 2 min) → firewall-drop 24 heures -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>local</location>
+    <rules_id>100210</rules_id>
+    <timeout>86400</timeout>
+  </active-response>
+
+  <active-response>
+    <disabled>no</disabled>
+    <command>host-deny</command>
+    <location>all</location>
+    <rules_id>100210</rules_id>
+    <timeout>86400</timeout>
+  </active-response>
+
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_id>100204,100206</rules_id>
+    <timeout>86400</timeout>
+  </active-response>
+
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Brute-force SSH (plusieurs échecs) → ban PERMANENT -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_group>authentication_failures</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Échec auth générique → ban PERMANENT -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_group>authentication_failed</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- SSH mauvais mot de passe → host-deny PERMANENT (double protection) -->
+  <active-response>
+    <command>host-deny</command>
+    <location>all</location>
+    <rules_id>5710,5711,5712,5716,5720,5760,5763</rules_id>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- Attaques web / injection (niveau ≥ 7) → firewall-drop 5 min -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <level>7</level>
+    <rules_group>web,attack</rules_group>
+    <timeout>300</timeout>
+  </active-response>
+
+  <!-- Scan de ports → firewall-drop 1 heure -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_id>1002,2502,2503,2504</rules_id>
+    <timeout>3600</timeout>
+  </active-response>
+
+  <!-- SSH brute-force → host-deny PERMANENT (double protection) -->
+  <active-response>
+    <command>host-deny</command>
+    <location>all</location>
+    <rules_group>authentication_failures,authentication_failed</rules_group>
+    <timeout>0</timeout>
+  </active-response>
+
+  <!-- ModSecurity SQLi / XSS / LFI → firewall-drop 6 heures -->
+  <active-response>
+    <command>firewall-drop</command>
+    <location>all</location>
+    <rules_id>100202,100203,100205</rules_id>
+    <timeout>21600</timeout>
+  </active-response>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       LOG ANALYSIS (commandes système)
+       ═══════════════════════════════════════════════════════════ -->
+  <localfile>
+    <log_format>command</log_format>
+    <command>df -P</command>
+    <frequency>360</frequency>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
+    <alias>netstat listening ports</alias>
+    <frequency>360</frequency>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>last -n 20</command>
+    <frequency>360</frequency>
+  </localfile>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       RULESET
+       ═══════════════════════════════════════════════════════════ -->
+  <ruleset>
+    <!-- Règles et decoders natifs Wazuh -->
+    <decoder_dir>ruleset/decoders</decoder_dir>
+    <rule_dir>ruleset/rules</rule_dir>
+    <!-- Règles exclues — non pertinentes pour ce stack -->
+    <rule_exclude>0025-sendmail_rules.xml</rule_exclude>
+    <rule_exclude>0030-postfix_rules.xml</rule_exclude>
+    <rule_exclude>0035-spamd_rules.xml</rule_exclude>
+    <rule_exclude>0040-imapd_rules.xml</rule_exclude>
+    <rule_exclude>0045-mailscanner_rules.xml</rule_exclude>
+    <rule_exclude>0050-ms-exchange_rules.xml</rule_exclude>
+    <rule_exclude>0055-courier_rules.xml</rule_exclude>
+    <rule_exclude>0065-pix_rules.xml</rule_exclude>
+    <rule_exclude>0070-netscreenfw_rules.xml</rule_exclude>
+    <rule_exclude>0075-cisco-ios_rules.xml</rule_exclude>
+    <rule_exclude>0080-sonicwall_rules.xml</rule_exclude>
+    <rule_exclude>0090-telnetd_rules.xml</rule_exclude>
+    <rule_exclude>0100-solaris_bsm_rules.xml</rule_exclude>
+    <rule_exclude>0105-asterisk_rules.xml</rule_exclude>
+    <rule_exclude>0110-ms_dhcp_rules.xml</rule_exclude>
+    <rule_exclude>0115-arpwatch_rules.xml</rule_exclude>
+    <rule_exclude>0130-trend-osce_rules.xml</rule_exclude>
+    <rule_exclude>0135-hordeimp_rules.xml</rule_exclude>
+    <rule_exclude>0155-dovecot_rules.xml</rule_exclude>
+    <rule_exclude>0160-vmpop3d_rules.xml</rule_exclude>
+    <rule_exclude>0165-vpopmail_rules.xml</rule_exclude>
+    <rule_exclude>0170-ftpd_rules.xml</rule_exclude>
+    <rule_exclude>0175-proftpd_rules.xml</rule_exclude>
+    <rule_exclude>0185-vsftpd_rules.xml</rule_exclude>
+    <rule_exclude>0190-ms_ftpd_rules.xml</rule_exclude>
+    <rule_exclude>0195-named_rules.xml</rule_exclude>
+    <rule_exclude>0215-policy_rules.xml</rule_exclude>
+    <rule_exclude>0750-github_rules.xml</rule_exclude>
+    <rule_exclude>0250-apache_rules.xml</rule_exclude>
+    <rule_exclude>0255-zeus_rules.xml</rule_exclude>
+    <rule_exclude>0265-php_rules.xml</rule_exclude>
+    <rule_exclude>0275-squid_rules.xml</rule_exclude>
+    <rule_exclude>0295-mysql_rules.xml</rule_exclude>
+    <rule_exclude>0305-dropbear_rules.xml</rule_exclude>
+    <rule_exclude>0315-apparmor_rules.xml</rule_exclude>
+    <rule_exclude>0320-clam_av_rules.xml</rule_exclude>
+    <rule_exclude>0350-amazon_rules.xml</rule_exclude>
+    <rule_exclude>0360-serv-u_rules.xml</rule_exclude>
+    <rule_exclude>0385-oscap_rules.xml</rule_exclude>
+    <rule_exclude>0390-fortiddos_rules.xml</rule_exclude>
+    <rule_exclude>0391-fortigate_rules.xml</rule_exclude>
+    <rule_exclude>0392-fortimail_rules.xml</rule_exclude>
+    <rule_exclude>0393-fortiauth_rules.xml</rule_exclude>
+    <rule_exclude>0120-symantec-av_rules.xml</rule_exclude>
+    <rule_exclude>0125-symantec-ws_rules.xml</rule_exclude>
+    <rule_exclude>0395-hp_rules.xml</rule_exclude>
+    <rule_exclude>0405-rsa-auth-manager_rules.xml</rule_exclude>
+    <rule_exclude>0410-imperva_rules.xml</rule_exclude>
+    <rule_exclude>0415-sophos_rules.xml</rule_exclude>
+    <rule_exclude>0990-amazon-security-lake_rules.xml</rule_exclude>
+    <rule_exclude>0435-ms_logs_rules.xml</rule_exclude>
+    <rule_exclude>0445-identity_guard_rules.xml</rule_exclude>
+    <rule_exclude>0450-mongodb_rules.xml</rule_exclude>
+    <rule_exclude>0460-jenkins_rules.xml</rule_exclude>
+    <rule_exclude>0470-vshell_rules.xml</rule_exclude>
+    <rule_exclude>0475-suricata_rules.xml</rule_exclude>
+    <rule_exclude>0480-qualysguard_rules.xml</rule_exclude>
+    <rule_exclude>0485-cylance_rules.xml</rule_exclude>
+    <rule_exclude>0700-paloalto_rules.xml</rule_exclude>
+    <rule_exclude>0500-owncloud_rules.xml</rule_exclude>
+    <rule_exclude>0505-vuls_rules.xml</rule_exclude>
+    <rule_exclude>0525-openvas_rules.xml</rule_exclude>
+    <rule_exclude>0530-mysql_audit_rules.xml</rule_exclude>
+    <rule_exclude>0535-mariadb_rules.xml</rule_exclude>
+    <rule_exclude>0540-pfsense_rules.xml</rule_exclude>
+    <rule_exclude>0545-osquery_rules.xml</rule_exclude>
+    <rule_exclude>0550-kaspersky_rules.xml</rule_exclude>
+    <rule_exclude>0555-azure_rules.xml</rule_exclude>
+    <rule_exclude>0565-ms_ipsec_rules.xml</rule_exclude>
+    <rule_exclude>0575-win-base_rules.xml</rule_exclude>
+    <rule_exclude>0580-win-security_rules.xml</rule_exclude>
+    <rule_exclude>0585-win-application_rules.xml</rule_exclude>
+    <rule_exclude>0590-win-system_rules.xml</rule_exclude>
+    <rule_exclude>0601-win-vipre_rules.xml</rule_exclude>
+    <rule_exclude>0602-win-wfirewall_rules.xml</rule_exclude>
+    <rule_exclude>0610-win-ms_logs_rules.xml</rule_exclude>
+    <rule_exclude>0630-nextcloud_rules.xml</rule_exclude>
+    <rule_exclude>0675-panda-paps_rules.xml</rule_exclude>
+    <rule_exclude>0680-checkpoint-smart1_rules.xml</rule_exclude>
+    <rule_exclude>0770-gitlab_rules.xml</rule_exclude>
+    <rule_exclude>0775-arbor_rules.xml</rule_exclude>
+    <rule_exclude>0780-fireeye_rules.xml</rule_exclude>
+    <rule_exclude>0785-huawei-usg_rules.xml</rule_exclude>
+    <rule_exclude>0800-sysmon_id_1.xml</rule_exclude>
+    <rule_exclude>0810-sysmon_id_3.xml</rule_exclude>
+    <rule_exclude>0820-sysmon_id_7.xml</rule_exclude>
+    <rule_exclude>0830-sysmon_id_11.xml</rule_exclude>
+    <rule_exclude>0840-win_event_channel.xml</rule_exclude>
+    <rule_exclude>0860-sysmon_id_13.xml</rule_exclude>
+    <rule_exclude>0870-sysmon_id_8.xml</rule_exclude>
+    <rule_exclude>0905-cisco-ftd_rules.xml</rule_exclude>
+    <rule_exclude>0690-gcp_rules.xml</rule_exclude>
+    <rule_exclude>0910-ms-exchange-proxylogon_rules.xml</rule_exclude>
+    <rule_exclude>0920-oracledb_rules.xml</rule_exclude>
+    <rule_exclude>0925-eset-remote_rules.xml</rule_exclude>
+    <rule_exclude>0955-WEF-baseline_rules.xml</rule_exclude>
+    <rule_exclude>0960-macos_rules.xml</rule_exclude>
+    <rule_exclude>0995-microsoft-graph_rules.xml</rule_exclude>
+    <rule_exclude>0755-office365_rules.xml</rule_exclude>
+    <rule_exclude>0140-roundcube_rules.xml</rule_exclude>
+    <rule_exclude>0998-aws-security-hub-rules.xml</rule_exclude>
+    <rule_exclude>0400-openvpn_rules.xml</rule_exclude>
+    <list>etc/lists/audit-keys</list>
+    <list>etc/lists/amazon/aws-eventnames</list>
+    <list>etc/lists/security-eventchannel</list>
+    <list>etc/lists/malicious-ioc/malicious-ip</list>
+    <list>etc/lists/malicious-ioc/malicious-domains</list>
+    <list>etc/lists/malicious-ioc/malware-hashes</list>
+    <!-- Decoders et règles custom ModSecurity -->
+    <decoder_dir>etc/decoders</decoder_dir>
+    <rule_dir>etc/rules</rule_dir>
+  </ruleset>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       RULE TEST
+       ═══════════════════════════════════════════════════════════ -->
+  <rule_test>
+    <enabled>yes</enabled>
+    <threads>1</threads>
+    <max_sessions>64</max_sessions>
+    <session_timeout>15m</session_timeout>
+  </rule_test>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       AUTHENTIFICATION AGENTS (wazuh-authd)
+       ═══════════════════════════════════════════════════════════ -->
+  <auth>
+    <disabled>no</disabled>
+    <port>1515</port>
+    <use_source_ip>no</use_source_ip>
+    <purge>yes</purge>
+    <use_password>no</use_password>
+    <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
+    <ssl_verify_host>no</ssl_verify_host>
+    <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
+    <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
+    <ssl_auto_negotiate>no</ssl_auto_negotiate>
+  </auth>
+
+  <!-- ═══════════════════════════════════════════════════════════
+       CLUSTER (standalone — désactivé)
+       ═══════════════════════════════════════════════════════════ -->
+  <cluster>
+    <name>wazuh</name>
+    <node_name>node01</node_name>
+    <node_type>master</node_type>
+    <key>aa093264ef885029653eea20dfcf51ae</key>
+    <port>1516</port>
+    <bind_addr>0.0.0.0</bind_addr>
+    <nodes>
+      <node>wazuh.manager</node>
+    </nodes>
+    <hidden>no</hidden>
+    <disabled>yes</disabled>
+  </cluster>
+
+</ossec_config>
+
+<ossec_config>
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/ossec/logs/active-responses.log</location>
+  </localfile>
+</ossec_config>
diff --git a/monitoring/wazuh/config/wazuh_manager/rules/modsecurity_rules.xml b/monitoring/wazuh/config/wazuh_manager/rules/modsecurity_rules.xml
new file mode 100644
index 00000000..058d1f52
--- /dev/null
+++ b/monitoring/wazuh/config/wazuh_manager/rules/modsecurity_rules.xml
@@ -0,0 +1,94 @@
+<group name="web,modsecurity,attack,">
+
+  <!-- ─────────────────────────────────────────────────────────
+       Règles de base (décodeurs modsecurity-block / warning)
+       ───────────────────────────────────────────────────────── -->
+
+  <!-- Bloc générique ModSecurity (403) -->
+  <rule id="100200" level="8">
+    <decoded_as>modsecurity-block</decoded_as>
+    <description>ModSecurity: requête bloquée ($(extra_data)) sur $(url)</description>
+    <group>modsecurity_block,</group>
+  </rule>
+
+  <!-- Warning générique ModSecurity (non-bloquant) -->
+  <rule id="100201" level="5">
+    <decoded_as>modsecurity-warning</decoded_as>
+    <description>ModSecurity: alerte $(extra_data) sur $(url)</description>
+    <group>modsecurity_warning,</group>
+  </rule>
+
+  <!-- ─────────────────────────────────────────────────────────
+       Règles spécialisées par type d'attaque
+       (parentes : 100200 — blocs déjà détectés)
+       ───────────────────────────────────────────────────────── -->
+
+  <!-- SQL Injection -->
+  <rule id="100202" level="12">
+    <if_sid>100200</if_sid>
+    <match>SQL Injection</match>
+    <description>ModSecurity: SQL Injection détecté depuis $(srcip) sur $(url)</description>
+    <group>modsecurity_sqli,sql_injection,</group>
+  </rule>
+
+  <!-- XSS -->
+  <rule id="100203" level="12">
+    <if_sid>100200</if_sid>
+    <match>XSS</match>
+    <description>ModSecurity: XSS détecté depuis $(srcip) sur $(url)</description>
+    <group>modsecurity_xss,xss,</group>
+  </rule>
+
+  <!-- Remote Code Execution -->
+  <rule id="100204" level="14">
+    <if_sid>100200</if_sid>
+    <match>RCE</match>
+    <description>ModSecurity: tentative RCE depuis $(srcip) sur $(url)</description>
+    <group>modsecurity_rce,rce,</group>
+  </rule>
+
+  <!-- Local File Inclusion -->
+  <rule id="100205" level="12">
+    <if_sid>100200</if_sid>
+    <match>LFI</match>
+    <description>ModSecurity: LFI détecté depuis $(srcip) sur $(url)</description>
+    <group>modsecurity_lfi,lfi,</group>
+  </rule>
+
+  <!-- Score d'anomalie critique -->
+  <rule id="100206" level="13">
+    <if_sid>100200</if_sid>
+    <match>Critical anomaly score\|anomaly score</match>
+    <description>ModSecurity: score d'anomalie critique depuis $(srcip)</description>
+    <group>modsecurity_anomaly,</group>
+  </rule>
+
+  <!-- IP bannie par ModSecurity (règle 100000) -->
+  <rule id="100207" level="10">
+    <if_sid>100200</if_sid>
+    <match>IP is banned\|ip.banned</match>
+    <description>ModSecurity: IP bannie $(srcip) tente un accès</description>
+    <group>modsecurity_banned,</group>
+  </rule>
+
+  <!-- Trop de requêtes (rate-limit 429) -->
+  <rule id="100208" level="6">
+    <decoded_as>modsecurity-block</decoded_as>
+    <field name="status">429</field>
+    <description>ModSecurity: rate-limit déclenché depuis $(srcip)</description>
+    <group>modsecurity_ratelimit,</group>
+  </rule>
+
+  <!-- ─────────────────────────────────────────────────────────
+       Règle de fréquence : blocages répétés → niveau critique
+       Déclenche active-response firewall-drop 24h
+       ───────────────────────────────────────────────────────── -->
+
+  <rule id="100210" level="14" frequency="5" timeframe="120">
+    <if_matched_sid>100200</if_matched_sid>
+    <same_srcip />
+    <description>ModSecurity: $(srcip) bloqué 5 fois en 2 min — attaque soutenue</description>
+    <group>modsecurity_repeated,</group>
+  </rule>
+
+</group>