<!--
  Sovereign Q sensor events for Wazuh (https://sovereignsystemslabs.com/security/developers)

  1. On the agent, collect the sensor's JSON lines (ossec.conf):
       <localfile>
         <log_format>json</log_format>
         <location>/var/log/sovereign-q.jsonl</location>
       </localfile>
     and run the sensor in watch mode with its jsonl option pointing at that file
     (the exact command is on the developers page).
  2. On the manager, copy this file to /var/ossec/etc/rules/sovereign-q_rules.xml,
     test with wazuh-logtest, then restart wazuh-manager.

  Rule IDs 100700 to 100709 sit in the range Wazuh reserves for local rules. Change them if they clash.
-->
<group name="sovereign_q,post_quantum,">

  <rule id="100700" level="3">
    <decoded_as>json</decoded_as>
    <field name="source">^sovereign-q$</field>
    <description>Sovereign Q: $(event) for $(target)</description>
  </rule>

  <rule id="100701" level="12">
    <if_sid>100700</if_sid>
    <field name="event">^downgrade$</field>
    <description>Sovereign Q: post-quantum protection lost on $(target), from $(from) to $(to). Possible misconfiguration or downgrade attack.</description>
    <mitre>
      <id>T1562.010</id>
    </mitre>
  </rule>

  <rule id="100702" level="7">
    <if_sid>100700</if_sid>
    <field name="event">^change$</field>
    <field name="exposure">^EXPOSED$</field>
    <description>Sovereign Q: $(target) uses classical key exchange ($(key_exchange)); traffic can be recorded now and decrypted later.</description>
  </rule>

  <rule id="100703" level="5">
    <if_sid>100700</if_sid>
    <field name="event">^change$</field>
    <field name="to">^down$</field>
    <description>Sovereign Q: $(target) stopped answering the sensor.</description>
  </rule>

  <rule id="100704" level="0">
    <if_sid>100700</if_sid>
    <field name="event">^heartbeat$</field>
    <description>Sovereign Q: sensor heartbeat.</description>
  </rule>

</group>
