feat: complete all SecOps tasks with full content

q2-incident-response/wazuh-rule.xml

@@ -0,0 +1,11 @@
+<group name="ghaymah_api,">
+  <rule id="100500" level="10">
+    <if_sid>5710</if_sid>
+    <match>/api/v1/auth/login</match>
+    <string>401</string>
+    <frequency>8</frequency>
+    <timeframe>60</timeframe>
+    <same_source_ip />
+    <description>Possible Brute Force Attack detected on Ghaymah Auth API</description>
+  </rule>
+</group>