0c916b50c6
feat(Exchange): VIP scan, disabled rules, first-baseline suppress (v1.6.1)
...
- VipMailboxes + VipMailboxPatterns; unified VIP scope
- Scan disabled inbox rules with external forward (lower severity)
- Suppress per-finding alerts on first baseline run
- Post-scan summary and install notification
2026-05-22 14:44:57 +10:00
9ab6cc64a1
docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0)
...
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
2026-05-22 14:32:50 +10:00
40c557f041
feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10)
...
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
2026-05-22 14:13:06 +10:00
a324841b7d
chore: clarify IIS log line wording for 4740 (v1.5.9)
2026-05-22 11:06:19 +10:00
a29ef8e0f7
config: LockoutMonitorDomainController K6A-DC3 (v1.5.8)
2026-05-22 11:01:38 +10:00
16d555037f
fix: daily report uses full path to quser.exe when System32 missing from PATH (v1.5.7)
2026-05-22 10:54:57 +10:00
ab98eab49c
fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6)
2026-05-22 10:41:59 +10:00
67c33fd4ff
config: IIS logs on fifth UNC path (v1.5.5)
2026-05-22 10:05:18 +10:00
6d7b4874ce
config: Kalina Telegram, DC3/B26 lockout, IIS path (v1.5.4)
2026-05-22 09:58:09 +10:00
52b1723137
feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3)
...
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
2026-05-19 20:46:35 +10:00
b7786e8690
feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2)
...
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.
2026-05-19 19:47:23 +10:00
938df9bfe0
fix: refresh ignore.lst each monitor loop for log/mtime (v1.4.4)
2026-05-04 10:22:03 +10:00
a3a5b45cf8
fix: ignore list startup line use -f format (avoid $kindLabel: parse), bump 1.4.3
2026-05-04 09:42:32 +10:00
362318707e
fix: PowerShell parse error for ignore list line (), bump 1.4.2
2026-05-04 09:40:34 +10:00
98031a20a1
fix: InstallTasks before DPAPI, deploy elevation and installtasks logs (1.4.1)
2026-05-04 09:38:02 +10:00
b3da911d51
chore: bump version to 1.4.0
2026-05-04 09:33:54 +10:00
d3154ceb1b
Add ignore.lst filtering for Security logon alerts
...
Support user/workstation/IP rules and Telegram-style lines; add ignore.lst.example; bump to 1.3.14.
2026-05-04 07:55:24 +10:00
99be51467e
Refine RD Gateway 303 semantics and show deploy update timestamp
2026-04-30 16:55:30 +10:00
a37a639be1
Fix RD Gateway 302/303 field mapping (XML + updated Properties layout).
...
Bump version to 1.3.12.
2026-04-30 16:05:21 +10:00
cc8925f88a
Start main task immediately after InstallTasks and include script version in startup notification.
...
Also bump script/version.txt to 1.3.11 for rollout tracking.
2026-04-29 16:45:13 +10:00
a20055f9d3
Singleton lock: DeleteOnClose, Ctrl+C propagates, release in finally (v1.3.9)
2026-04-29 16:23:16 +10:00
313cc189e9
v1.3.5: путь скрипта при Start-Process, диагностика watchdog, DEPLOY.md
2026-04-29 16:13:14 +10:00
e0b0fa3d7e
Watchdog: schtasks /Run после установки; DEPLOY/README про задачи и UNC; версия 1.3.4
2026-04-29 16:07:35 +10:00
80f57c5351
Добавлен доменный деплой (Deploy-LoginMonitor.ps1, version.txt), DEPLOY.md, правки README и комментарий к версии в Login_Monitor.ps1
2026-04-29 15:14:41 +10:00
PTah