From f67168f55a7d3817f2c606c589b54c753f2ac9bb Mon Sep 17 00:00:00 2001
From: Xor290 <free6nk33@gmail.com>
Date: Fri, 8 May 2026 21:37:45 +0200
Subject: [PATCH] chore: update rules wazuh

---
 .../rules/local_ssh_pam_noise.xml             | 76 +++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 monitoring/wazuh/config/wazuh_manager/rules/local_ssh_pam_noise.xml

diff --git a/monitoring/wazuh/config/wazuh_manager/rules/local_ssh_pam_noise.xml b/monitoring/wazuh/config/wazuh_manager/rules/local_ssh_pam_noise.xml
new file mode 100644
index 00000000..d04aa6b8
--- /dev/null
+++ b/monitoring/wazuh/config/wazuh_manager/rules/local_ssh_pam_noise.xml
@@ -0,0 +1,76 @@
+<!-- ═══════════════════════════════════════════════════════════════════
+     Réduction du bruit SSH/PAM — overrides des règles natives Wazuh
+     ═══════════════════════════════════════════════════════════════════
+
+     Supprimés (level 0) : événements sans valeur sécurité générés en masse
+     Conservés intacts   : tout ce qui alimente l'active-response et la
+                           détection de brute-force (5710, 5716, 5720, 5760, 5763…)
+-->
+
+<!-- ─── PAM ──────────────────────────────────────────────────────────── -->
+<group name="pam,syslog,">
+
+  <!-- 5501 (level 3) → PAM "session opened" : redondant avec 5715 sshd auth success -->
+  <rule id="5501" level="0" overwrite="yes">
+    <if_sid>5500</if_sid>
+    <match>session opened for user </match>
+    <description>PAM: Login session opened (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5502 (level 3) → PAM "session closed" : purement informatif -->
+  <rule id="5502" level="0" overwrite="yes">
+    <if_sid>5500</if_sid>
+    <match>session closed for user </match>
+    <description>PAM: Login session closed (bruit supprimé).</description>
+  </rule>
+
+</group>
+
+<!-- ─── SSH ──────────────────────────────────────────────────────────── -->
+<group name="syslog,sshd,">
+
+  <!-- 5704 (level 4) → timeout individuel : la règle de fréquence 5705
+       (level 10) continue de compter et d'alerter sur les patterns -->
+  <rule id="5704" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>fatal: Timeout before authentication for</match>
+    <description>sshd: Timeout individuel supprimé (fréquence 5705 active).</description>
+  </rule>
+
+  <!-- 5706 (level 6) → "Did not receive identification string" : scanners
+       qui touchent le port 22 sans finir le handshake, très fréquent -->
+  <rule id="5706" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Did not receive identification string from</match>
+    <description>sshd: Sonde sans identification (bruit de scan supprimé).</description>
+  </rule>
+
+  <!-- 5740 (level 4) → connection reset by peer : bruit réseau/bots -->
+  <rule id="5740" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection reset by peer$</match>
+    <description>sshd: Connection reset by peer (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5741 (level 4) → connection refused : pas d'intérêt sur un agent -->
+  <rule id="5741" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection refused$</match>
+    <description>sshd: Connection refused (bruit supprimé).</description>
+  </rule>
+
+  <!-- 5749 (level 4) → bad packet length : scanners/bots -->
+  <rule id="5749" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>^Bad packet length</match>
+    <description>sshd: Bad packet length (bruit de scan supprimé).</description>
+  </rule>
+
+  <!-- 5762 (level 4) → connection reset : doublon de 5740 -->
+  <rule id="5762" level="0" overwrite="yes">
+    <if_sid>5700</if_sid>
+    <match>Connection reset</match>
+    <description>sshd: Connection reset (bruit supprimé).</description>
+  </rule>
+
+</group>