[#825] SOC sweep: UCS machine-account suppression (CR 24) + churn root causes

https://projects.knownelement.com/issues/825

docs/wazuh-tuning.md

@@ -93,3 +93,16 @@ sshd successes: visible for triage, below every notification path.
 5. Re-check email volume at coo@ weekly; tune further only on evidence.
 6. Vulnerability backlog: OpenVAS scans (GLPI-fed targets) → tickets per the triage
    standard; Wazuh vuln alerts feed the same weekly review.
+
+## Sweep additions
+
+**2026-09-06 (CR 24):** rule 100520 (L3) — UCS machine-account SSH probe suppression:
+`tsys-ucs-02$` → tsys-ucs-01 every 20 min is a UCS domain artifact (verified in
+auth.log), not an intrusion. Narrow match: if_sid 5710 + srcip 100.68.10.17 + pcre2
+`Invalid user tsys-ucs-02\$`. All other invalid-user attempts stay L5. Gotchas that
+bit during apply: `srcuser` is not a valid rule element in 4.14 (use regex on the log),
+OSMatch `$` anchors and does not escape reliably — use `<regex type="pcre2">`.
+
+**Known remaining churn (L3, dashboard-only, tracked):** 40704 systemd failures
+dominated by `nut-driver@tripplite.service` (pfv-tsys5) and `dell-fan-control.service`
+(pfv-tsys9) arriving via remote syslog — infra-ops crash-loops, not security.

rules/local_rules.xml

@@ -159,6 +159,12 @@
     <description>Cloudron: PHP file in uploads dir - #823-pattern webshell staging (41 webshells found there 2026-09-06).</description>
     <mitre><id>T1505.003</id></mitre>
   </rule>
+  <rule id="100520" level="3">
+    <if_sid>5710</if_sid>
+    <srcip>100.68.10.17</srcip>
+    <regex type="pcre2">Invalid user tsys-ucs-02\$</regex>
+    <description>UCS machine-account SSH probe (tsys-ucs-02$ from tsys-ucs-02 every 20min, UCS domain artifact CR 24 - dispositioned L3).</description>
+  </rule>
   <rule id="100510" level="8">
     <if_sid>31100, 31101, 31103, 31104, 31106, 31108, 31109, 31110, 31115, 31120, 31121, 31122, 31123</if_sid>
     <match>uploads/.*\.php</match>