chore: add crowdsec
This commit is contained in:
@@ -1,22 +0,0 @@
|
|||||||
# Logs nginx depuis le container Docker
|
|
||||||
source: docker
|
|
||||||
container_name:
|
|
||||||
- monitoring_nginx
|
|
||||||
labels:
|
|
||||||
type: nginx
|
|
||||||
|
|
||||||
---
|
|
||||||
# Logs SSH du VPS hôte
|
|
||||||
source: file
|
|
||||||
filenames:
|
|
||||||
- /var/log/auth.log
|
|
||||||
labels:
|
|
||||||
type: syslog
|
|
||||||
|
|
||||||
---
|
|
||||||
# Logs système du VPS hôte
|
|
||||||
source: file
|
|
||||||
filenames:
|
|
||||||
- /var/log/syslog
|
|
||||||
labels:
|
|
||||||
type: syslog
|
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
mode: iptables
|
||||||
|
update_frequency: 10s
|
||||||
|
log_mode: stdout
|
||||||
|
log_level: info
|
||||||
|
api_url: http://127.0.0.1:7777
|
||||||
|
api_key: monitoring-bouncer-key-2026
|
||||||
|
insecure_skip_verify: false
|
||||||
|
disable_ipv6: false
|
||||||
|
deny_action: DROP
|
||||||
|
deny_log: false
|
||||||
|
supported_decisions_types:
|
||||||
|
- ban
|
||||||
|
iptables_chains:
|
||||||
|
- INPUT
|
||||||
|
- FORWARD
|
||||||
|
- DOCKER-USER
|
||||||
@@ -18,10 +18,11 @@ services:
|
|||||||
container_name: monitoring_nginx
|
container_name: monitoring_nginx
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
ports:
|
ports:
|
||||||
- "80:80"
|
- "10.0.0.2:80:80"
|
||||||
- "443:443"
|
- "10.0.0.2:443:443"
|
||||||
- "8080:8080"
|
- "10.0.0.2:8080:8080"
|
||||||
- "8090:8090"
|
- "10.0.0.2:8090:8090"
|
||||||
|
- "10.0.0.2:3001:3001"
|
||||||
volumes:
|
volumes:
|
||||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||||
- ./nginx/certs:/etc/nginx/certs:ro
|
- ./nginx/certs:/etc/nginx/certs:ro
|
||||||
@@ -101,6 +102,9 @@ services:
|
|||||||
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
||||||
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||||
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||||
|
- crowdsec_logs:/var/log/crowdsec:ro
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- /usr/bin/docker:/usr/local/bin/docker:ro
|
||||||
networks:
|
networks:
|
||||||
- monitoring_net
|
- monitoring_net
|
||||||
|
|
||||||
@@ -156,6 +160,49 @@ services:
|
|||||||
- wazuh.manager
|
- wazuh.manager
|
||||||
networks:
|
networks:
|
||||||
- monitoring_net
|
- monitoring_net
|
||||||
|
uptime-kuma:
|
||||||
|
image: louislam/uptime-kuma:1
|
||||||
|
container_name: uptime-kuma
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- uptime_kuma_data:/app/data
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
|
||||||
|
# ─── CrowdSec LAPI ────────────────────────────────────────
|
||||||
|
crowdsec:
|
||||||
|
image: crowdsecurity/crowdsec:latest
|
||||||
|
container_name: crowdsec
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd"
|
||||||
|
GID: "0"
|
||||||
|
volumes:
|
||||||
|
- /var/log:/var/log/host:ro
|
||||||
|
- nginx_logs:/var/log/nginx:ro
|
||||||
|
- crowdsec_data:/var/lib/crowdsec/data
|
||||||
|
- crowdsec_config:/etc/crowdsec
|
||||||
|
- crowdsec_logs:/var/log/crowdsec
|
||||||
|
ports:
|
||||||
|
- "127.0.0.1:7777:8080"
|
||||||
|
- "10.0.0.2:8081:8080"
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── CrowdSec Firewall Bouncer ────────────────────────────
|
||||||
|
crowdsec-bouncer:
|
||||||
|
image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest
|
||||||
|
container_name: crowdsec-bouncer
|
||||||
|
restart: unless-stopped
|
||||||
|
network_mode: host
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN
|
||||||
|
- NET_RAW
|
||||||
|
volumes:
|
||||||
|
- ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro
|
||||||
|
depends_on:
|
||||||
|
- crowdsec
|
||||||
networks:
|
networks:
|
||||||
monitoring_net:
|
monitoring_net:
|
||||||
driver: bridge
|
driver: bridge
|
||||||
@@ -177,3 +224,7 @@ volumes:
|
|||||||
beszel_data:
|
beszel_data:
|
||||||
clamav_data:
|
clamav_data:
|
||||||
clamav_logs:
|
clamav_logs:
|
||||||
|
crowdsec_data:
|
||||||
|
crowdsec_config:
|
||||||
|
crowdsec_logs:
|
||||||
|
uptime_kuma_data:
|
||||||
|
|||||||
@@ -0,0 +1,57 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Wazuh Active Response -> CrowdSec ban
|
||||||
|
|
||||||
|
read INPUT
|
||||||
|
|
||||||
|
SRC_IP=$(echo "$INPUT" | python3 -c "
|
||||||
|
import sys, json, re
|
||||||
|
try:
|
||||||
|
d = json.load(sys.stdin)
|
||||||
|
alert = d.get('parameters', {}).get('alert', {})
|
||||||
|
data = alert.get('data', {})
|
||||||
|
# 1. Try standard srcip field
|
||||||
|
ip = data.get('srcip') or data.get('src_ip') or ''
|
||||||
|
# 2. Fallback: extract first public IP from full_log
|
||||||
|
if not ip:
|
||||||
|
full_log = alert.get('full_log', '')
|
||||||
|
ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
|
||||||
|
private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
|
||||||
|
for candidate in ips:
|
||||||
|
if not private.match(candidate):
|
||||||
|
ip = candidate
|
||||||
|
break
|
||||||
|
print(ip)
|
||||||
|
except:
|
||||||
|
print('')
|
||||||
|
" 2>/dev/null)
|
||||||
|
|
||||||
|
ACTION=$(echo "$INPUT" | python3 -c "
|
||||||
|
import sys, json
|
||||||
|
try:
|
||||||
|
d = json.load(sys.stdin)
|
||||||
|
print(d.get('command', 'add'))
|
||||||
|
except:
|
||||||
|
print('add')
|
||||||
|
" 2>/dev/null)
|
||||||
|
|
||||||
|
LOG=/var/ossec/logs/active-responses.log
|
||||||
|
|
||||||
|
if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
|
||||||
|
echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Ne pas bannir les IPs privees / VPN
|
||||||
|
if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
|
||||||
|
echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$ACTION" = "delete" ]; then
|
||||||
|
/usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
|
||||||
|
echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
|
||||||
|
else
|
||||||
|
/usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
|
||||||
|
--duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
|
||||||
|
echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
|
||||||
|
fi
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
<!-- CrowdSec Decoders — format logrus key=value -->
|
||||||
|
<decoder name="crowdsec">
|
||||||
|
<prematch>^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d</prematch>
|
||||||
|
</decoder>
|
||||||
|
|
||||||
|
<decoder name="crowdsec-fields">
|
||||||
|
<parent>crowdsec</parent>
|
||||||
|
<regex>level=(\S+) msg="(\.+)"</regex>
|
||||||
|
<order>status,extra_data</order>
|
||||||
|
</decoder>
|
||||||
|
|
||||||
|
<decoder name="crowdsec-ban">
|
||||||
|
<parent>crowdsec</parent>
|
||||||
|
<prematch>ban Ip |ban ip |type":"ban</prematch>
|
||||||
|
<regex>(\d+\.\d+\.\d+\.\d+)</regex>
|
||||||
|
<order>srcip</order>
|
||||||
|
</decoder>
|
||||||
|
|
||||||
|
<decoder name="crowdsec-overflow">
|
||||||
|
<parent>crowdsec</parent>
|
||||||
|
<prematch>overflow from |triggered |New overflow</prematch>
|
||||||
|
<regex>'(\d+\.\d+\.\d+\.\d+)'</regex>
|
||||||
|
<order>srcip</order>
|
||||||
|
</decoder>
|
||||||
@@ -517,138 +517,6 @@
|
|||||||
<timeout>21600</timeout>
|
<timeout>21600</timeout>
|
||||||
</active-response>
|
</active-response>
|
||||||
|
|
||||||
<!-- ═══════════════════════════════════════════════════════════
|
|
||||||
OWASP — Remontées (non-bloquées, anomaly scoring)
|
|
||||||
═══════════════════════════════════════════════════════════ -->
|
|
||||||
|
|
||||||
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h (soft) -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100320</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100394</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100321</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#3 Command Injection anomaly CRITICAL (100396) → permanent ban -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100396</rules_id>
|
|
||||||
<timeout>0</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#3 LDAP/PHP/Java remontées (100322, 100323) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100322,100323</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#6 RCE/Exploit remontée (100330) → firewall-drop 6h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100330</rules_id>
|
|
||||||
<timeout>21600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100340</rules_id>
|
|
||||||
<timeout>3600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100395</rules_id>
|
|
||||||
<timeout>21600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 Header Injection remontée (100341) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100341</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 Path Traversal remontée (100350) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100350</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 RFI remontée (100351) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100351</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 File Access remontée (100352) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100352</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#8 XXE remontée (100360) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100360</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#9 Scanner remontée (100370) → firewall-drop 30min -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100370</rules_id>
|
|
||||||
<timeout>1800</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP SSRF remontée (100380) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100380</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP File Upload remontée (100381) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>local</location>
|
|
||||||
<rules_id>100381</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<active-response>
|
<active-response>
|
||||||
<disabled>no</disabled>
|
<disabled>no</disabled>
|
||||||
<command>host-deny</command>
|
<command>host-deny</command>
|
||||||
@@ -892,137 +760,47 @@
|
|||||||
<timeout>21600</timeout>
|
<timeout>21600</timeout>
|
||||||
</active-response>
|
</active-response>
|
||||||
|
|
||||||
<!-- ═══════════════════════════════════════════════════════════
|
<!-- ════════════════════════════════════════════════════════════
|
||||||
OWASP — Remontées (location=all)
|
CROWDSEC ACTIVE RESPONSE
|
||||||
═══════════════════════════════════════════════════════════ -->
|
════════════════════════════════════════════════════════════ -->
|
||||||
|
<command>
|
||||||
|
<name>crowdsec-ban</name>
|
||||||
|
<executable>crowdsec-ban.sh</executable>
|
||||||
|
<timeout_allowed>yes</timeout_allowed>
|
||||||
|
</command>
|
||||||
|
|
||||||
<!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h -->
|
<!-- SSH Brute Force → CrowdSec ban 24h -->
|
||||||
<active-response>
|
<active-response>
|
||||||
<command>firewall-drop</command>
|
<command>crowdsec-ban</command>
|
||||||
<location>all</location>
|
<location>local</location>
|
||||||
<rules_id>100320</rules_id>
|
<rules_id>5712,5720,5763</rules_id>
|
||||||
<timeout>7200</timeout>
|
<timeout>86400</timeout>
|
||||||
</active-response>
|
</active-response>
|
||||||
|
|
||||||
<!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
|
<!-- Attaques web WAF/OWASP → CrowdSec ban 12h -->
|
||||||
<active-response>
|
<active-response>
|
||||||
<command>firewall-drop</command>
|
<command>crowdsec-ban</command>
|
||||||
<location>all</location>
|
<location>local</location>
|
||||||
<rules_id>100394</rules_id>
|
<rules_id>100270,100280,100281</rules_id>
|
||||||
<timeout>14400</timeout>
|
<timeout>43200</timeout>
|
||||||
</active-response>
|
</active-response>
|
||||||
|
|
||||||
<!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
|
<!-- CrowdSec ban détecté dans ses propres logs → ban 24h -->
|
||||||
<active-response>
|
<active-response>
|
||||||
<command>firewall-drop</command>
|
<command>crowdsec-ban</command>
|
||||||
<location>all</location>
|
<location>local</location>
|
||||||
<rules_id>100321</rules_id>
|
<rules_id>100501,100502</rules_id>
|
||||||
<timeout>14400</timeout>
|
<timeout>86400</timeout>
|
||||||
</active-response>
|
</active-response>
|
||||||
|
|
||||||
<!-- OWASP#3 Command Injection CRITICAL (100396) → permanent -->
|
<!-- ════════════════════════════════════════════════════════════
|
||||||
<active-response>
|
CROWDSEC LOG MONITORING
|
||||||
<command>firewall-drop</command>
|
════════════════════════════════════════════════════════════ -->
|
||||||
<location>all</location>
|
<localfile>
|
||||||
<rules_id>100396</rules_id>
|
<log_format>syslog</log_format>
|
||||||
<timeout>0</timeout>
|
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||||
</active-response>
|
</localfile>
|
||||||
|
|
||||||
<!-- OWASP#3 LDAP/PHP/Java (100322, 100323) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100322,100323</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#6 RCE/Exploit (100330) → firewall-drop 6h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100330</rules_id>
|
|
||||||
<timeout>21600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100340</rules_id>
|
|
||||||
<timeout>3600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100395</rules_id>
|
|
||||||
<timeout>21600</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#7 Header Injection (100341) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100341</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 Path Traversal (100350) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100350</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 RFI (100351) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100351</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#1 File Access (100352) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100352</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#8 XXE (100360) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100360</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP#9 Scanner (100370) → firewall-drop 30min -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100370</rules_id>
|
|
||||||
<timeout>1800</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP SSRF (100380) → firewall-drop 4h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100380</rules_id>
|
|
||||||
<timeout>14400</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- OWASP File Upload (100381) → firewall-drop 2h -->
|
|
||||||
<active-response>
|
|
||||||
<command>firewall-drop</command>
|
|
||||||
<location>all</location>
|
|
||||||
<rules_id>100381</rules_id>
|
|
||||||
<timeout>7200</timeout>
|
|
||||||
</active-response>
|
|
||||||
|
|
||||||
<!-- ═══════════════════════════════════════════════════════════
|
<!-- ═══════════════════════════════════════════════════════════
|
||||||
LOG ANALYSIS (commandes système)
|
LOG ANALYSIS (commandes système)
|
||||||
|
|||||||
@@ -0,0 +1,42 @@
|
|||||||
|
<!-- CrowdSec Rules — IDs 100500-100509 -->
|
||||||
|
<group name="crowdsec,">
|
||||||
|
|
||||||
|
<!-- Base: logs CrowdSec/logrus (pattern simple, sans \d) -->
|
||||||
|
<rule id="100500" level="3">
|
||||||
|
<location>/var/log/crowdsec/crowdsec.log</location>
|
||||||
|
<description>CrowdSec: event logged</description>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<!-- IP bannie par CrowdSec -->
|
||||||
|
<rule id="100501" level="10">
|
||||||
|
<if_sid>100500</if_sid>
|
||||||
|
<match>ban Ip |ban ip | ban on Ip |Ip ban</match>
|
||||||
|
<description>CrowdSec: IP banned by decision engine</description>
|
||||||
|
<group>crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<!-- Nouvelle attaque detectee -->
|
||||||
|
<rule id="100502" level="8">
|
||||||
|
<if_sid>100500</if_sid>
|
||||||
|
<match>overflow from |triggered |New overflow|crowdsecurity/</match>
|
||||||
|
<description>CrowdSec: Attack scenario detected</description>
|
||||||
|
<group>crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,</group>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<!-- Erreur CrowdSec -->
|
||||||
|
<rule id="100503" level="7">
|
||||||
|
<if_sid>100500</if_sid>
|
||||||
|
<match>level=error</match>
|
||||||
|
<description>CrowdSec: Error logged</description>
|
||||||
|
<group>crowdsec_error,</group>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<!-- Erreur critique CrowdSec -->
|
||||||
|
<rule id="100504" level="12">
|
||||||
|
<if_sid>100500</if_sid>
|
||||||
|
<match>level=fatal|level=panic</match>
|
||||||
|
<description>CrowdSec: Critical error — service may be down</description>
|
||||||
|
<group>crowdsec_error,</group>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
</group>
|
||||||
Reference in New Issue
Block a user