Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: add crowdsec

Browse Source
This commit is contained in:
Xor290
2026-06-15 14:46:02 +02:00
parent d552798934
commit bcdee141c1
7 changed files with 224 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml
+24
View File
@@ -0,0 +1,24 @@
<!-- CrowdSec Decoders — format logrus key=value -->
<decoder name="crowdsec">
<prematch>^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d</prematch>
</decoder>
<decoder name="crowdsec-fields">
<parent>crowdsec</parent>
<regex>level=(\S+) msg="(\.+)"</regex>
<order>status,extra_data</order>
</decoder>
<decoder name="crowdsec-ban">
<parent>crowdsec</parent>
<prematch>ban Ip |ban ip |type":"ban</prematch>
<regex>(\d+\.\d+\.\d+\.\d+)</regex>
<order>srcip</order>
</decoder>
<decoder name="crowdsec-overflow">
<parent>crowdsec</parent>
<prematch>overflow from |triggered |New overflow</prematch>
<regex>'(\d+\.\d+\.\d+\.\d+)'</regex>
<order>srcip</order>
</decoder>
monitoring/security/wazuh/config/wazuh_manager/ossec.conf
+30 -252
View File
@@ -517,138 +517,6 @@
<timeout>21600</timeout>
</active-response>
<!-- ═══════════════════════════════════════════════════════════
OWASP — Remontées (non-bloquées, anomaly scoring)
═══════════════════════════════════════════════════════════ -->
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h (soft) -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100320</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100394</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100321</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#3 Command Injection anomaly CRITICAL (100396) → permanent ban -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100396</rules_id>
<timeout>0</timeout>
</active-response>
<!-- OWASP#3 LDAP/PHP/Java remontées (100322, 100323) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100322,100323</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#6 RCE/Exploit remontée (100330) → firewall-drop 6h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100330</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100340</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100395</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- OWASP#7 Header Injection remontée (100341) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100341</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#1 Path Traversal remontée (100350) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100350</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#1 RFI remontée (100351) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100351</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#1 File Access remontée (100352) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100352</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#8 XXE remontée (100360) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100360</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#9 Scanner remontée (100370) → firewall-drop 30min -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100370</rules_id>
<timeout>1800</timeout>
</active-response>
<!-- OWASP SSRF remontée (100380) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100380</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP File Upload remontée (100381) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>100381</rules_id>
<timeout>7200</timeout>
</active-response>
<active-response>
<disabled>no</disabled>
<command>host-deny</command>
@@ -892,137 +760,47 @@
<timeout>21600</timeout>
</active-response>
<!-- ═══════════════════════════════════════════════════════════
OWASP — Remontées (location=all)
═══════════════════════════════════════════════════════════ -->
<!-- ════════════════════════════════════════════════════════════
CROWDSEC ACTIVE RESPONSE
════════════════════════════════════════════════════════════ -->
<command>
<name>crowdsec-ban</name>
<executable>crowdsec-ban.sh</executable>
<timeout_allowed>yes</timeout_allowed>
</command>
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h -->
<!-- SSH Brute Force → CrowdSec ban 24h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100320</rules_id>
<timeout>7200</timeout>
<command>crowdsec-ban</command>
<location>local</location>
<rules_id>5712,5720,5763</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
<!-- Attaques web WAF/OWASP → CrowdSec ban 12h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100394</rules_id>
<timeout>14400</timeout>
<command>crowdsec-ban</command>
<location>local</location>
<rules_id>100270,100280,100281</rules_id>
<timeout>43200</timeout>
</active-response>
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
<!-- CrowdSec ban détecté dans ses propres logs → ban 24h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100321</rules_id>
<timeout>14400</timeout>
<command>crowdsec-ban</command>
<location>local</location>
<rules_id>100501,100502</rules_id>
<timeout>86400</timeout>
</active-response>
<!-- OWASP#3 Command Injection CRITICAL (100396) → permanent -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100396</rules_id>
<timeout>0</timeout>
</active-response>
<!-- ════════════════════════════════════════════════════════════
CROWDSEC LOG MONITORING
════════════════════════════════════════════════════════════ -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/crowdsec/crowdsec.log</location>
</localfile>
<!-- OWASP#3 LDAP/PHP/Java (100322, 100323) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100322,100323</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#6 RCE/Exploit (100330) → firewall-drop 6h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100330</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100340</rules_id>
<timeout>3600</timeout>
</active-response>
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100395</rules_id>
<timeout>21600</timeout>
</active-response>
<!-- OWASP#7 Header Injection (100341) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100341</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#1 Path Traversal (100350) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100350</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#1 RFI (100351) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100351</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#1 File Access (100352) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100352</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- OWASP#8 XXE (100360) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100360</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP#9 Scanner (100370) → firewall-drop 30min -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100370</rules_id>
<timeout>1800</timeout>
</active-response>
<!-- OWASP SSRF (100380) → firewall-drop 4h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100380</rules_id>
<timeout>14400</timeout>
</active-response>
<!-- OWASP File Upload (100381) → firewall-drop 2h -->
<active-response>
<command>firewall-drop</command>
<location>all</location>
<rules_id>100381</rules_id>
<timeout>7200</timeout>
</active-response>
<!-- ═══════════════════════════════════════════════════════════
LOG ANALYSIS (commandes système)
monitoring/security/wazuh/config/wazuh_manager/rules/crowdsec-rules.xml
+42
View File
@@ -0,0 +1,42 @@
<!-- CrowdSec Rules — IDs 100500-100509 -->
<group name="crowdsec,">
<!-- Base: logs CrowdSec/logrus (pattern simple, sans \d) -->
<rule id="100500" level="3">
<location>/var/log/crowdsec/crowdsec.log</location>
<description>CrowdSec: event logged</description>
</rule>
<!-- IP bannie par CrowdSec -->
<rule id="100501" level="10">
<if_sid>100500</if_sid>
<match>ban Ip |ban ip | ban on Ip |Ip ban</match>
<description>CrowdSec: IP banned by decision engine</description>
<group>crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
</rule>
<!-- Nouvelle attaque detectee -->
<rule id="100502" level="8">
<if_sid>100500</if_sid>
<match>overflow from |triggered |New overflow|crowdsecurity/</match>
<description>CrowdSec: Attack scenario detected</description>
<group>crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,</group>
</rule>
<!-- Erreur CrowdSec -->
<rule id="100503" level="7">
<if_sid>100500</if_sid>
<match>level=error</match>
<description>CrowdSec: Error logged</description>
<group>crowdsec_error,</group>
</rule>
<!-- Erreur critique CrowdSec -->
<rule id="100504" level="12">
<if_sid>100500</if_sid>
<match>level=fatal|level=panic</match>
<description>CrowdSec: Critical error — service may be down</description>
<group>crowdsec_error,</group>
</rule>
</group>