chore: fix wazuh modsecurity decoder + noise rules

- Réécriture modsecurity_decoder.xml pour le format JSON audit
  libmodsecurity3 (Docker JSON log, log_format:json)
  Décoders séparés : blocked (403), rule, pass
- Nouveau local_modsecurity_rules.xml : alertes niveaux 6/10/12
  pour règles déclenchées, blocages 403 et scan répété
- local_ssh_pam_noise.xml : rule 100001 → 100010 (évite conflit
  avec le placeholder de local_rules.xml)
- Fix mln-uber ossec.conf : gestion-waf log filename .log.json → -json.log
- docker-compose.yml + wazuh.indexer.yml : upgrade 4.14.4 → 4.14.5
  + compatibility.override_main_response_version: true

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-05-09 00:33:50 +02:00
co-authored by Claude Sonnet 4.6
parent f67168f55a
commit d4cf2f23d4
5 changed files with 130 additions and 26 deletions
+3 -3
View File
@@ -34,7 +34,7 @@ services:
# ─── Wazuh Manager ────────────────────────────────────────
wazuh.manager:
image: wazuh/wazuh-manager:4.14.4
image: wazuh/wazuh-manager:4.14.5
hostname: wazuh.manager
container_name: wazuh_manager
restart: unless-stopped
@@ -81,7 +81,7 @@ services:
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
wazuh.indexer:
image: wazuh/wazuh-indexer:4.14.4
image: wazuh/wazuh-indexer:4.14.5
hostname: wazuh.indexer
container_name: wazuh_indexer
restart: unless-stopped
@@ -109,7 +109,7 @@ services:
# ─── Wazuh Dashboard ──────────────────────────────────────
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.4
image: wazuh/wazuh-dashboard:4.14.5
hostname: wazuh.dashboard
container_name: wazuh_dashboard
restart: unless-stopped