From 9f680dfd8909c7e4c66eb42f7d891d8b5f30e935 Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Mon, 13 Apr 2026 10:59:02 +1000
Subject: [PATCH] Telegram Security events: show log server vs workstation
 (4624/4625)

---
 Login_Monitor.ps1 | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/Login_Monitor.ps1 b/Login_Monitor.ps1
index f374a6e..69594ef 100644
--- a/Login_Monitor.ps1
+++ b/Login_Monitor.ps1
@@ -656,9 +656,13 @@ function Format-LoginEvent {
         [string]$ProcessName,
         [datetime]$TimeCreated,
         [int]$LogonType,
-        [string]$LogonTypeName
+        [string]$LogonTypeName,
+        [string]$SecurityLogComputerName
     )
 
+    $logHost = $SecurityLogComputerName
+    if ([string]::IsNullOrWhiteSpace($logHost)) { $logHost = $env:COMPUTERNAME }
+
     $message = "<b>"
     if ($EventID -eq 4624) { $message += "✅ УСПЕШНЫЙ ВХОД" }
     elseif ($EventID -eq 4625) { $message += "❌ НЕУДАЧНАЯ ПОПЫТКА" }
@@ -666,7 +670,8 @@ function Format-LoginEvent {
     $message += "</b>`r`n"
 
     $message += "👤 Пользователь: $Username`r`n"
-    $message += "🖥️ Компьютер: $ComputerName`r`n"
+    $message += "🏢 Сервер (журнал Security): $logHost`r`n"
+    $message += "🖥️ Рабочая станция (клиент из события): $ComputerName`r`n"
     $message += "🌐 IP адрес: $SourceIP`r`n"
     $message += "⚙️ Процесс/Код: $ProcessName`r`n"
     $message += "🔑 Тип входа: $LogonTypeName ($LogonType)`r`n"
@@ -884,7 +889,8 @@ function Start-LoginMonitor {
                             -ProcessName $eventInfo.ProcessName `
                             -TimeCreated $eventInfo.TimeCreated `
                             -LogonType $eventInfo.LogonType `
-                            -LogonTypeName $logonTypeName
+                            -LogonTypeName $logonTypeName `
+                            -SecurityLogComputerName $event.MachineName
 
                         Write-Log "Notify: ID=$($event.Id) User=$($eventInfo.Username) LT=$($eventInfo.LogonType) IP=$($eventInfo.SourceIP)"
                         Send-TelegramMessage -Message $formattedMessage | Out-Null