58 lines
1.7 KiB
Bash
Executable File
58 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Wazuh Active Response -> CrowdSec ban
|
|
|
|
read INPUT
|
|
|
|
SRC_IP=$(echo "$INPUT" | python3 -c "
|
|
import sys, json, re
|
|
try:
|
|
d = json.load(sys.stdin)
|
|
alert = d.get('parameters', {}).get('alert', {})
|
|
data = alert.get('data', {})
|
|
# 1. Try standard srcip field
|
|
ip = data.get('srcip') or data.get('src_ip') or ''
|
|
# 2. Fallback: extract first public IP from full_log
|
|
if not ip:
|
|
full_log = alert.get('full_log', '')
|
|
ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
|
|
private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
|
|
for candidate in ips:
|
|
if not private.match(candidate):
|
|
ip = candidate
|
|
break
|
|
print(ip)
|
|
except:
|
|
print('')
|
|
" 2>/dev/null)
|
|
|
|
ACTION=$(echo "$INPUT" | python3 -c "
|
|
import sys, json
|
|
try:
|
|
d = json.load(sys.stdin)
|
|
print(d.get('command', 'add'))
|
|
except:
|
|
print('add')
|
|
" 2>/dev/null)
|
|
|
|
LOG=/var/ossec/logs/active-responses.log
|
|
|
|
if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
|
|
echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
|
|
exit 0
|
|
fi
|
|
|
|
# Ne pas bannir les IPs privees / VPN
|
|
if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
|
|
echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
|
|
exit 0
|
|
fi
|
|
|
|
if [ "$ACTION" = "delete" ]; then
|
|
/usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
|
|
echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
|
|
else
|
|
/usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
|
|
--duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
|
|
echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
|
|
fi
|