diff --git a/monitoring/crowdsec/acquis.yaml b/monitoring/crowdsec/acquis.yaml
deleted file mode 100644
index a54e4da8..00000000
--- a/monitoring/crowdsec/acquis.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Logs nginx depuis le container Docker
-source: docker
-container_name:
- - monitoring_nginx
-labels:
- type: nginx
-
----
-# Logs SSH du VPS hôte
-source: file
-filenames:
- - /var/log/auth.log
-labels:
- type: syslog
-
----
-# Logs système du VPS hôte
-source: file
-filenames:
- - /var/log/syslog
-labels:
- type: syslog
diff --git a/monitoring/security/crowdsec/bouncer-monitoring.yaml b/monitoring/security/crowdsec/bouncer-monitoring.yaml
new file mode 100644
index 00000000..f53ac873
--- /dev/null
+++ b/monitoring/security/crowdsec/bouncer-monitoring.yaml
@@ -0,0 +1,16 @@
+mode: iptables
+update_frequency: 10s
+log_mode: stdout
+log_level: info
+api_url: http://127.0.0.1:7777
+api_key: monitoring-bouncer-key-2026
+insecure_skip_verify: false
+disable_ipv6: false
+deny_action: DROP
+deny_log: false
+supported_decisions_types:
+ - ban
+iptables_chains:
+ - INPUT
+ - FORWARD
+ - DOCKER-USER
diff --git a/monitoring/security/docker-compose-security.yml b/monitoring/security/docker-compose-security.yml
index fbb0f397..7fdd3cd7 100755
--- a/monitoring/security/docker-compose-security.yml
+++ b/monitoring/security/docker-compose-security.yml
@@ -18,10 +18,11 @@ services:
container_name: monitoring_nginx
restart: unless-stopped
ports:
- - "80:80"
- - "443:443"
- - "8080:8080"
- - "8090:8090"
+ - "10.0.0.2:80:80"
+ - "10.0.0.2:443:443"
+ - "10.0.0.2:8080:8080"
+ - "10.0.0.2:8090:8090"
+ - "10.0.0.2:3001:3001"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
@@ -101,6 +102,9 @@ services:
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+ - crowdsec_logs:/var/log/crowdsec:ro
+ - /var/run/docker.sock:/var/run/docker.sock
+ - /usr/bin/docker:/usr/local/bin/docker:ro
networks:
- monitoring_net
@@ -156,6 +160,49 @@ services:
- wazuh.manager
networks:
- monitoring_net
+ uptime-kuma:
+ image: louislam/uptime-kuma:1
+ container_name: uptime-kuma
+ restart: unless-stopped
+ volumes:
+ - uptime_kuma_data:/app/data
+ networks:
+ - monitoring_net
+
+
+ # ─── CrowdSec LAPI ────────────────────────────────────────
+ crowdsec:
+ image: crowdsecurity/crowdsec:latest
+ container_name: crowdsec
+ restart: unless-stopped
+ environment:
+ COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd"
+ GID: "0"
+ volumes:
+ - /var/log:/var/log/host:ro
+ - nginx_logs:/var/log/nginx:ro
+ - crowdsec_data:/var/lib/crowdsec/data
+ - crowdsec_config:/etc/crowdsec
+ - crowdsec_logs:/var/log/crowdsec
+ ports:
+ - "127.0.0.1:7777:8080"
+ - "10.0.0.2:8081:8080"
+ networks:
+ - monitoring_net
+
+ # ─── CrowdSec Firewall Bouncer ────────────────────────────
+ crowdsec-bouncer:
+ image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest
+ container_name: crowdsec-bouncer
+ restart: unless-stopped
+ network_mode: host
+ cap_add:
+ - NET_ADMIN
+ - NET_RAW
+ volumes:
+ - ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro
+ depends_on:
+ - crowdsec
networks:
monitoring_net:
driver: bridge
@@ -177,3 +224,7 @@ volumes:
beszel_data:
clamav_data:
clamav_logs:
+ crowdsec_data:
+ crowdsec_config:
+ crowdsec_logs:
+ uptime_kuma_data:
diff --git a/monitoring/security/wazuh/active-response/crowdsec-ban.sh b/monitoring/security/wazuh/active-response/crowdsec-ban.sh
new file mode 100755
index 00000000..cedb2c99
--- /dev/null
+++ b/monitoring/security/wazuh/active-response/crowdsec-ban.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+# Wazuh Active Response -> CrowdSec ban
+
+read INPUT
+
+SRC_IP=$(echo "$INPUT" | python3 -c "
+import sys, json, re
+try:
+ d = json.load(sys.stdin)
+ alert = d.get('parameters', {}).get('alert', {})
+ data = alert.get('data', {})
+ # 1. Try standard srcip field
+ ip = data.get('srcip') or data.get('src_ip') or ''
+ # 2. Fallback: extract first public IP from full_log
+ if not ip:
+ full_log = alert.get('full_log', '')
+ ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
+ private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
+ for candidate in ips:
+ if not private.match(candidate):
+ ip = candidate
+ break
+ print(ip)
+except:
+ print('')
+" 2>/dev/null)
+
+ACTION=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+ d = json.load(sys.stdin)
+ print(d.get('command', 'add'))
+except:
+ print('add')
+" 2>/dev/null)
+
+LOG=/var/ossec/logs/active-responses.log
+
+if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
+ echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
+ exit 0
+fi
+
+# Ne pas bannir les IPs privees / VPN
+if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
+ echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
+ exit 0
+fi
+
+if [ "$ACTION" = "delete" ]; then
+ /usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
+ echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
+else
+ /usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
+ --duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
+ echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
+fi
diff --git a/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml b/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml
new file mode 100644
index 00000000..a3236de3
--- /dev/null
+++ b/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml
@@ -0,0 +1,24 @@
+
+
+ ^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d
+
+
+
+ crowdsec
+ level=(\S+) msg="(\.+)"
+ status,extra_data
+
+
+
+ crowdsec
+ ban Ip |ban ip |type":"ban
+ (\d+\.\d+\.\d+\.\d+)
+ srcip
+
+
+
+ crowdsec
+ overflow from |triggered |New overflow
+ '(\d+\.\d+\.\d+\.\d+)'
+ srcip
+
diff --git a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
index 11c09c9f..49fb55d2 100755
--- a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
+++ b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf
@@ -517,138 +517,6 @@
21600
-
-
-
-
- firewall-drop
- local
- 100320
- 7200
-
-
-
-
- firewall-drop
- local
- 100394
- 14400
-
-
-
-
- firewall-drop
- local
- 100321
- 14400
-
-
-
-
- firewall-drop
- local
- 100396
- 0
-
-
-
-
- firewall-drop
- local
- 100322,100323
- 7200
-
-
-
-
- firewall-drop
- local
- 100330
- 21600
-
-
-
-
- firewall-drop
- local
- 100340
- 3600
-
-
-
-
- firewall-drop
- local
- 100395
- 21600
-
-
-
-
- firewall-drop
- local
- 100341
- 7200
-
-
-
-
- firewall-drop
- local
- 100350
- 7200
-
-
-
-
- firewall-drop
- local
- 100351
- 14400
-
-
-
-
- firewall-drop
- local
- 100352
- 7200
-
-
-
-
- firewall-drop
- local
- 100360
- 14400
-
-
-
-
- firewall-drop
- local
- 100370
- 1800
-
-
-
-
- firewall-drop
- local
- 100380
- 14400
-
-
-
-
- firewall-drop
- local
- 100381
- 7200
-
-
no
host-deny
@@ -892,137 +760,47 @@
21600
-
+
+
+ crowdsec-ban
+ crowdsec-ban.sh
+ yes
+
-
+
- firewall-drop
- all
- 100320
- 7200
+ crowdsec-ban
+ local
+ 5712,5720,5763
+ 86400
-
+
- firewall-drop
- all
- 100394
- 14400
+ crowdsec-ban
+ local
+ 100270,100280,100281
+ 43200
-
+
- firewall-drop
- all
- 100321
- 14400
+ crowdsec-ban
+ local
+ 100501,100502
+ 86400
-
-
- firewall-drop
- all
- 100396
- 0
-
+
+
+ syslog
+ /var/log/crowdsec/crowdsec.log
+
-
-
- firewall-drop
- all
- 100322,100323
- 7200
-
-
-
-
- firewall-drop
- all
- 100330
- 21600
-
-
-
-
- firewall-drop
- all
- 100340
- 3600
-
-
-
-
- firewall-drop
- all
- 100395
- 21600
-
-
-
-
- firewall-drop
- all
- 100341
- 7200
-
-
-
-
- firewall-drop
- all
- 100350
- 7200
-
-
-
-
- firewall-drop
- all
- 100351
- 14400
-
-
-
-
- firewall-drop
- all
- 100352
- 7200
-
-
-
-
- firewall-drop
- all
- 100360
- 14400
-
-
-
-
- firewall-drop
- all
- 100370
- 1800
-
-
-
-
- firewall-drop
- all
- 100380
- 14400
-
-
-
-
- firewall-drop
- all
- 100381
- 7200
-
+
+
+
+
+ /var/log/crowdsec/crowdsec.log
+ CrowdSec: event logged
+
+
+
+
+ 100500
+ ban Ip |ban ip | ban on Ip |Ip ban
+ CrowdSec: IP banned by decision engine
+ crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,
+
+
+
+
+ 100500
+ overflow from |triggered |New overflow|crowdsecurity/
+ CrowdSec: Attack scenario detected
+ crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,
+
+
+
+
+ 100500
+ level=error
+ CrowdSec: Error logged
+ crowdsec_error,
+
+
+
+
+ 100500
+ level=fatal|level=panic
+ CrowdSec: Critical error — service may be down
+ crowdsec_error,
+
+
+