chore: add crowdsec
This commit is contained in:
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Active Response -> CrowdSec ban
|
||||
|
||||
read INPUT
|
||||
|
||||
SRC_IP=$(echo "$INPUT" | python3 -c "
|
||||
import sys, json, re
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
alert = d.get('parameters', {}).get('alert', {})
|
||||
data = alert.get('data', {})
|
||||
# 1. Try standard srcip field
|
||||
ip = data.get('srcip') or data.get('src_ip') or ''
|
||||
# 2. Fallback: extract first public IP from full_log
|
||||
if not ip:
|
||||
full_log = alert.get('full_log', '')
|
||||
ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
|
||||
private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
|
||||
for candidate in ips:
|
||||
if not private.match(candidate):
|
||||
ip = candidate
|
||||
break
|
||||
print(ip)
|
||||
except:
|
||||
print('')
|
||||
" 2>/dev/null)
|
||||
|
||||
ACTION=$(echo "$INPUT" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
print(d.get('command', 'add'))
|
||||
except:
|
||||
print('add')
|
||||
" 2>/dev/null)
|
||||
|
||||
LOG=/var/ossec/logs/active-responses.log
|
||||
|
||||
if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
|
||||
echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Ne pas bannir les IPs privees / VPN
|
||||
if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
|
||||
echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$ACTION" = "delete" ]; then
|
||||
/usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
|
||||
echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
|
||||
else
|
||||
/usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
|
||||
--duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
|
||||
echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
|
||||
fi
|
||||
@@ -0,0 +1,24 @@
|
||||
<!-- CrowdSec Decoders — format logrus key=value -->
|
||||
<decoder name="crowdsec">
|
||||
<prematch>^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d</prematch>
|
||||
</decoder>
|
||||
|
||||
<decoder name="crowdsec-fields">
|
||||
<parent>crowdsec</parent>
|
||||
<regex>level=(\S+) msg="(\.+)"</regex>
|
||||
<order>status,extra_data</order>
|
||||
</decoder>
|
||||
|
||||
<decoder name="crowdsec-ban">
|
||||
<parent>crowdsec</parent>
|
||||
<prematch>ban Ip |ban ip |type":"ban</prematch>
|
||||
<regex>(\d+\.\d+\.\d+\.\d+)</regex>
|
||||
<order>srcip</order>
|
||||
</decoder>
|
||||
|
||||
<decoder name="crowdsec-overflow">
|
||||
<parent>crowdsec</parent>
|
||||
<prematch>overflow from |triggered |New overflow</prematch>
|
||||
<regex>'(\d+\.\d+\.\d+\.\d+)'</regex>
|
||||
<order>srcip</order>
|
||||
</decoder>
|
||||
@@ -517,138 +517,6 @@
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ═══════════════════════════════════════════════════════════
|
||||
OWASP — Remontées (non-bloquées, anomaly scoring)
|
||||
═══════════════════════════════════════════════════════════ -->
|
||||
|
||||
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h (soft) -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100320</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100394</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100321</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 Command Injection anomaly CRITICAL (100396) → permanent ban -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100396</rules_id>
|
||||
<timeout>0</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 LDAP/PHP/Java remontées (100322, 100323) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100322,100323</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#6 RCE/Exploit remontée (100330) → firewall-drop 6h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100330</rules_id>
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100340</rules_id>
|
||||
<timeout>3600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100395</rules_id>
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 Header Injection remontée (100341) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100341</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 Path Traversal remontée (100350) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100350</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 RFI remontée (100351) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100351</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 File Access remontée (100352) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100352</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#8 XXE remontée (100360) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100360</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#9 Scanner remontée (100370) → firewall-drop 30min -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100370</rules_id>
|
||||
<timeout>1800</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP SSRF remontée (100380) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100380</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP File Upload remontée (100381) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>local</location>
|
||||
<rules_id>100381</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<active-response>
|
||||
<disabled>no</disabled>
|
||||
<command>host-deny</command>
|
||||
@@ -892,137 +760,47 @@
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ═══════════════════════════════════════════════════════════
|
||||
OWASP — Remontées (location=all)
|
||||
═══════════════════════════════════════════════════════════ -->
|
||||
<!-- ════════════════════════════════════════════════════════════
|
||||
CROWDSEC ACTIVE RESPONSE
|
||||
════════════════════════════════════════════════════════════ -->
|
||||
<command>
|
||||
<name>crowdsec-ban</name>
|
||||
<executable>crowdsec-ban.sh</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h -->
|
||||
<!-- SSH Brute Force → CrowdSec ban 24h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100320</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>5712,5720,5763</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
|
||||
<!-- Attaques web WAF/OWASP → CrowdSec ban 12h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100394</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100270,100280,100281</rules_id>
|
||||
<timeout>43200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
|
||||
<!-- CrowdSec ban détecté dans ses propres logs → ban 24h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100321</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
<command>crowdsec-ban</command>
|
||||
<location>local</location>
|
||||
<rules_id>100501,100502</rules_id>
|
||||
<timeout>86400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#3 Command Injection CRITICAL (100396) → permanent -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100396</rules_id>
|
||||
<timeout>0</timeout>
|
||||
</active-response>
|
||||
<!-- ════════════════════════════════════════════════════════════
|
||||
CROWDSEC LOG MONITORING
|
||||
════════════════════════════════════════════════════════════ -->
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||
</localfile>
|
||||
|
||||
<!-- OWASP#3 LDAP/PHP/Java (100322, 100323) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100322,100323</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#6 RCE/Exploit (100330) → firewall-drop 6h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100330</rules_id>
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100340</rules_id>
|
||||
<timeout>3600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100395</rules_id>
|
||||
<timeout>21600</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#7 Header Injection (100341) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100341</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 Path Traversal (100350) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100350</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 RFI (100351) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100351</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#1 File Access (100352) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100352</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#8 XXE (100360) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100360</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP#9 Scanner (100370) → firewall-drop 30min -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100370</rules_id>
|
||||
<timeout>1800</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP SSRF (100380) → firewall-drop 4h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100380</rules_id>
|
||||
<timeout>14400</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- OWASP File Upload (100381) → firewall-drop 2h -->
|
||||
<active-response>
|
||||
<command>firewall-drop</command>
|
||||
<location>all</location>
|
||||
<rules_id>100381</rules_id>
|
||||
<timeout>7200</timeout>
|
||||
</active-response>
|
||||
|
||||
<!-- ═══════════════════════════════════════════════════════════
|
||||
LOG ANALYSIS (commandes système)
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
<!-- CrowdSec Rules — IDs 100500-100509 -->
|
||||
<group name="crowdsec,">
|
||||
|
||||
<!-- Base: logs CrowdSec/logrus (pattern simple, sans \d) -->
|
||||
<rule id="100500" level="3">
|
||||
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||
<description>CrowdSec: event logged</description>
|
||||
</rule>
|
||||
|
||||
<!-- IP bannie par CrowdSec -->
|
||||
<rule id="100501" level="10">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>ban Ip |ban ip | ban on Ip |Ip ban</match>
|
||||
<description>CrowdSec: IP banned by decision engine</description>
|
||||
<group>crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Nouvelle attaque detectee -->
|
||||
<rule id="100502" level="8">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>overflow from |triggered |New overflow|crowdsecurity/</match>
|
||||
<description>CrowdSec: Attack scenario detected</description>
|
||||
<group>crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Erreur CrowdSec -->
|
||||
<rule id="100503" level="7">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>level=error</match>
|
||||
<description>CrowdSec: Error logged</description>
|
||||
<group>crowdsec_error,</group>
|
||||
</rule>
|
||||
|
||||
<!-- Erreur critique CrowdSec -->
|
||||
<rule id="100504" level="12">
|
||||
<if_sid>100500</if_sid>
|
||||
<match>level=fatal|level=panic</match>
|
||||
<description>CrowdSec: Critical error — service may be down</description>
|
||||
<group>crowdsec_error,</group>
|
||||
</rule>
|
||||
|
||||
</group>
|
||||
Reference in New Issue
Block a user