diff --git a/evidence/backup/restoration_2025-10-26.md b/evidence/backup/restoration_2025-10-26.md
new file mode 100644
index 0000000..d887114
--- /dev/null
+++ b/evidence/backup/restoration_2025-10-26.md
@@ -0,0 +1,11 @@
+# Rapport de test de restauration
+Service: artefact-build | Environnement: test | Date: <'"'"$(date +%F)"'"'> | Exécutant: <toi>
+RPO visé: <15min> | RTO visé: <15min>
+## Étapes
+1. Source: artifact.tar.gz (hash à joindre)
+2. Procédure: extraction tar et vérification de contenu
+3. Horodatage début/fin (UTC): <à compléter>
+4. Validation: artefact lisible
+## Résultats
+- Durée totale: <à compléter> | RTO atteint: oui/non
+- Point de reprise: <horodatage> | RPO atteint: oui/non
diff --git a/evidence/detection/alert_test_2025-10-26.md b/evidence/detection/alert_test_2025-10-26.md
new file mode 100644
index 0000000..5586684
--- /dev/null
+++ b/evidence/detection/alert_test_2025-10-26.md
@@ -0,0 +1,3 @@
+# Alerte test — détection d'auth anormale
+Horodatage: '"'"$(date -u +%F\ %T\ UTC)"'"'
+Preuve: Alerte simulée pour valider le pipeline de détection.
diff --git a/registrar.yaml b/registrar.yaml
new file mode 100644
index 0000000..a31f41a
--- /dev/null
+++ b/registrar.yaml
@@ -0,0 +1,24 @@
+security:
+  idp:
+    issuer: https://idp.example.org/realms/ab
+    mfa: { required: true, phish_resistant_only: true }
+  vault:
+    addr: https://vault.example.org
+    namespace: alliance-boreale
+    auth_method: oidc
+    secret_refs: [ "vault://kv/example#dsn" ]
+  pivot_c5:
+    mtls: { required: true }
+  logging:
+    split_federated_tenant: true
+    retention_days: 90
+    time_source: { ntp_servers: [time.cloudflare.com] }
+  backup:
+    immutable_copy: true
+    frequency: daily
+    test_frequency: quarterly
+    last_restore_test_at: null
+  incident:
+    sev_matrix_ref: repo://security/incidents/severity-matrix.md
+    oncall_rotation_ref: repo://security/incidents/oncall.md
+    status_page_url: https://status.example.org
diff --git a/security/detection/rules/rule-auth-anomaly.yml b/security/detection/rules/rule-auth-anomaly.yml
new file mode 100644
index 0000000..d294b62
--- /dev/null
+++ b/security/detection/rules/rule-auth-anomaly.yml
@@ -0,0 +1,9 @@
+title: Suspicious Admin Login
+id: AB-DR-001
+status: test
+description: Detects admin login containing 'admin' in username
+logsource: { product: auth }
+detection:
+  selection: { username|contains: admin }
+  condition: selection
+level: medium