chore(compliance): minima registrar + preuves tests (alerte, restauration)

evidence/backup/restoration_2025-10-26.md

@@ -0,0 +1,11 @@
+# Rapport de test de restauration
+Service: artefact-build | Environnement: test | Date: <'"'"$(date +%F)"'"'> | Exécutant: <toi>
+RPO visé: <15min> | RTO visé: <15min>
+## Étapes
+1. Source: artifact.tar.gz (hash à joindre)
+2. Procédure: extraction tar et vérification de contenu
+3. Horodatage début/fin (UTC): <à compléter>
+4. Validation: artefact lisible
+## Résultats
+- Durée totale: <à compléter> | RTO atteint: oui/non
+- Point de reprise: <horodatage> | RPO atteint: oui/non

evidence/detection/alert_test_2025-10-26.md

@@ -0,0 +1,3 @@
+# Alerte test — détection d'auth anormale
+Horodatage: '"'"$(date -u +%F\ %T\ UTC)"'"'
+Preuve: Alerte simulée pour valider le pipeline de détection.

registrar.yaml

@@ -0,0 +1,24 @@
+security:
+  idp:
+    issuer: https://idp.example.org/realms/ab
+    mfa: { required: true, phish_resistant_only: true }
+  vault:
+    addr: https://vault.example.org
+    namespace: alliance-boreale
+    auth_method: oidc
+    secret_refs: [ "vault://kv/example#dsn" ]
+  pivot_c5:
+    mtls: { required: true }
+  logging:
+    split_federated_tenant: true
+    retention_days: 90
+    time_source: { ntp_servers: [time.cloudflare.com] }
+  backup:
+    immutable_copy: true
+    frequency: daily
+    test_frequency: quarterly
+    last_restore_test_at: null
+  incident:
+    sev_matrix_ref: repo://security/incidents/severity-matrix.md
+    oncall_rotation_ref: repo://security/incidents/oncall.md
+    status_page_url: https://status.example.org

security/detection/rules/rule-auth-anomaly.yml

@@ -0,0 +1,9 @@
+title: Suspicious Admin Login
+id: AB-DR-001
+status: test
+description: Detects admin login containing 'admin' in username
+logsource: { product: auth }
+detection:
+  selection: { username|contains: admin }
+  condition: selection
+level: medium