5fc5f2a9ad
feat: monitor admin share access via Security 5140 C$/ADMIN$ (2.0.19-SAC)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-04 10:14:14 +10:00
724baa6c0a
feat: monitor RDS Shadow Control and WinRM inbound (warning alerts, 1.2.23-SAC)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-30 10:20:57 +10:00
52b1723137
feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3)
...
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
2026-05-19 20:46:35 +10:00
57bc617d26
Sanitize ignore.lst.example placeholders
...
Replace sample workstation, domain user, and IP with generic values.
2026-05-04 08:25:21 +10:00
d3154ceb1b
Add ignore.lst filtering for Security logon alerts
...
Support user/workstation/IP rules and Telegram-style lines; add ignore.lst.example; bump to 1.3.14.
2026-05-04 07:55:24 +10:00
PTah