chore: fix wazuh modsecurity decoder + noise rules
- Réécriture modsecurity_decoder.xml pour le format JSON audit libmodsecurity3 (Docker JSON log, log_format:json) Décoders séparés : blocked (403), rule, pass - Nouveau local_modsecurity_rules.xml : alertes niveaux 6/10/12 pour règles déclenchées, blocages 403 et scan répété - local_ssh_pam_noise.xml : rule 100001 → 100010 (évite conflit avec le placeholder de local_rules.xml) - Fix mln-uber ossec.conf : gestion-waf log filename .log.json → -json.log - docker-compose.yml + wazuh.indexer.yml : upgrade 4.14.4 → 4.14.5 + compatibility.override_main_response_version: true Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -34,7 +34,7 @@ services:
|
||||
|
||||
# ─── Wazuh Manager ────────────────────────────────────────
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:4.14.4
|
||||
image: wazuh/wazuh-manager:4.14.5
|
||||
hostname: wazuh.manager
|
||||
container_name: wazuh_manager
|
||||
restart: unless-stopped
|
||||
@@ -81,7 +81,7 @@ services:
|
||||
|
||||
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:4.14.4
|
||||
image: wazuh/wazuh-indexer:4.14.5
|
||||
hostname: wazuh.indexer
|
||||
container_name: wazuh_indexer
|
||||
restart: unless-stopped
|
||||
@@ -109,7 +109,7 @@ services:
|
||||
|
||||
# ─── Wazuh Dashboard ──────────────────────────────────────
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.14.4
|
||||
image: wazuh/wazuh-dashboard:4.14.5
|
||||
hostname: wazuh.dashboard
|
||||
container_name: wazuh_dashboard
|
||||
restart: unless-stopped
|
||||
|
||||
Reference in New Issue
Block a user