Compare commits

..

31 Commits

Author SHA1 Message Date
PTah f9db03a01b fix: heartbeat only to SAC, never Telegram/email
agent.heartbeat in Send-NotifyOrSac skips local channels in dual/fallback/off.
Bump to 1.2.6-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-28 07:56:18 +10:00
PTah 9893e9c599 chore: bump release to 1.2.5-SAC
Raise ScriptVersion/version.txt for Sac-Client payload product_version and
update README release reference to keep docs aligned.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 15:53:29 +10:00
PTah 6774ff77d1 feat: bootstrap SAC settings on deploy when upgrading from pre-SAC
Deploy overwrites login_monitor.settings.ps1 from the trusted example when
Sac-Client.ps1 or SacApiKey/UseSAC are missing, with a .bak backup. Skips
overwrite when SAC is already configured; continues deploy on version match
if SAC bootstrap is still required.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 15:23:32 +10:00
PTah 17c14fa5bc fix: do not stop monitor when SAC /health is temporarily down
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 15:02:07 +10:00
PTah ecceb70cc7 fix: deploy graceful recycle writes restart.request directly (no 90s wait)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 14:53:54 +10:00
PTah cbcf87ca2a chore: bump version to 1.2.2-SAC
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 14:44:02 +10:00
PTah 3e0f556f6d feat: graceful restart without Stop-Process; SAC key in settings example
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 14:43:04 +10:00
PTah 8a10e471db docs: Windows/SAC update checklist; default Telegram in settings example
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 14:27:27 +10:00
PTah d3d836432b feat: SAC client 1.2.0-SAC and daily report details for ingest
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-27 14:15:16 +10:00
PTah 77bec04cfe feat(Login): вынести локальные настройки в login_monitor.settings.ps1
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
2026-05-25 09:44:43 +10:00
PTah 9ea647d905 fix(Exchange): stop Import-ExchangeManagementShell leaking True (v1.6.7)
return True from EMS import was collected into mailbox lists and domain joins, causing Get-InboxRule on mailbox True. Suppress import output at call sites and log accepted domains via @() enumeration.
2026-05-22 16:10:36 +10:00
PTah 96d9c88a4a fix(Exchange): define Get-ExchangeInboxScanScopeLabel before InstallTasks (v1.6.6) 2026-05-22 16:02:05 +10:00
PTah 423fa49d35 feat(Exchange): skip corrupt inbox rule stores (v1.6.5)
Add SkipInboxScanMailboxes with k.selezneva@kalinamall.ru by default. Filter inbox scan list, log SKIP, and catch Get-InboxRule failures to avoid Watson aborting full scans.
2026-05-22 16:00:09 +10:00
PTah 407ddf2454 fix(deploy): copy exchange_monitor.settings.example to ProgramData (v1.6.4)
Example settings were published to NETLOGON but omitted from Deploy-DomainMonitors file list, so Copy-Item from ProgramData failed on fresh installs.
2026-05-22 15:00:30 +10:00
PTah e90beae974 fix: Exchange monitor encoding for PS 5.1 (v1.6.3)
ASCII runtime strings in Exchange-MailSecurity and Notify-Common avoid parser errors when scripts are copied without UTF-8 BOM. Deploy copies .ps1 to ProgramData with UTF-8 BOM via Copy-ScriptFileWithUtf8Bom.
2026-05-22 14:57:35 +10:00
PTah 0c7c2254cf fix: Deploy-DomainMonitors encoding for PS 5.1 / NETLOGON (v1.6.2)
- ASCII runtime strings in domain deploy/install scripts
- Publish *.ps1 to NETLOGON with UTF-8 BOM
2026-05-22 14:53:28 +10:00
PTah f41effc845 feat(Exchange): VIP scan, disabled rules, first-baseline suppress (v1.6.1)
- VipMailboxes + VipMailboxPatterns; unified VIP scope
- Scan disabled inbox rules with external forward (lower severity)
- Suppress per-finding alerts on first baseline run
- Post-scan summary and install notification
2026-05-22 14:44:57 +10:00
PTah 1eaa9b6d21 docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0)
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
2026-05-22 14:32:50 +10:00
PTah ea26f1d8b7 feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10)
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
2026-05-22 14:13:06 +10:00
PTah f89b7f5b2f chore: clarify IIS log line wording for 4740 (v1.5.9) 2026-05-22 11:06:19 +10:00
PTah b3189cbf01 config: LockoutMonitorDomainController K6A-DC3 (v1.5.8) 2026-05-22 11:01:38 +10:00
PTah 813b2cda99 fix: daily report uses full path to quser.exe when System32 missing from PATH (v1.5.7) 2026-05-22 10:54:57 +10:00
PTah b1fa6ec9f1 fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6) 2026-05-22 10:41:59 +10:00
PTah 844d1ce520 Fixed BOM 2026-05-22 10:28:40 +10:00
PTah dfcc0fc3fd config: fifth IIS UNC, NETLOGON publish script (v1.5.5) 2026-05-22 10:13:54 +10:00
PTah 06c2b6cbf7 config: IIS logs on fifth UNC path (v1.5.5) 2026-05-22 10:05:18 +10:00
PTah 0c683c796c config: Kalina Telegram, DC3/B26 lockout, IIS path (v1.5.4) 2026-05-22 09:58:09 +10:00
PTah 8f25ca78ad readme and docs editing 2026-05-22 09:19:26 +10:00
PTah 1b192cea7c feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3)
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-19 20:46:35 +10:00
PTah 2c73526f7c feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2)
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-19 19:47:23 +10:00
PTah 4015f9a7e4 fix: refresh ignore.lst each monitor loop for log/mtime (v1.4.4)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-04 10:22:03 +10:00
2 changed files with 67 additions and 2 deletions
+65
View File
@@ -0,0 +1,65 @@
# Çàâèñèìîñòè è ïàêåòû
node_modules/
bower_components/
jspm_packages/
.npm/
vendor/
.pnpm-store/
# Âèðòóàëüíûå îêðóæåíèÿ (Python)
.venv/
venv/
env/
ENV/
.env/
# Ñáîðêà, êýø è àðòåôàêòû
dist/
build/
out/
.next/
.nuxt/
.docusaurus/
.cache/
.sass-cache/
.turbo/
target/
bin/
obj/
# Ñèñòåìíûå ïàïêè IDE è ëîãè
.git/
.svn/
.idea/
.vscode/
.cursor/
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
# Ìåäèà, øðèôòû è òÿæåëûå áèíàðíûå ôàéëû
*.png
*.jpg
*.jpeg
*.gif
*.svg
*.ico
*.mp4
*.mp3
*.pdf
*.zip
*.tar.gz
*.rar
*.exe
*.dll
*.woff
*.woff2
*.ttf
*.eot
# Ñãåíåðèðîâàííûå ôàéëû áëîêèðîâîê (îïöèîíàëüíî, ýêîíîìÿò ìíîãî òîêåíîâ)
package-lock.json
yarn.lock
pnpm-lock.yaml
poetry.lock
+2 -2
View File
@@ -225,7 +225,7 @@ function Invoke-SacPostPayload {
'Idempotency-Key' = $eventId 'Idempotency-Key' = $eventId
} }
$resp = Invoke-WebRequest -Uri $ingest -Method Post -Headers $headers -Body $JsonBody -UseBasicParsing -TimeoutSec $timeout $resp = Invoke-WebRequest -Uri $ingest -Method Post -Headers $headers -Body $JsonBody -UseBasicParsing -TimeoutSec $timeout
if ($resp.StatusCode -in 201, 409, 202) { if ($resp.StatusCode -eq 202) {
Remove-SacSpoolFile -EventId $eventId Remove-SacSpoolFile -EventId $eventId
Reset-SacFailCount Reset-SacFailCount
Write-SacLog "SAC: accepted event_id=$eventId type=$eventType" Write-SacLog "SAC: accepted event_id=$eventId type=$eventType"
@@ -393,7 +393,7 @@ function Test-SacConnection {
return 1 return 1
} }
if (Send-SacEvent -EventType 'agent.test' -Severity 'info' -Title 'SAC test' -Summary 'rdp-login-monitor CheckSac') { if (Send-SacEvent -EventType 'agent.test' -Severity 'info' -Title 'SAC test' -Summary 'rdp-login-monitor CheckSac') {
Write-Host 'SAC ingest agent.test: OK (expected HTTP 201)' Write-Host 'SAC ingest agent.test: OK (expected HTTP 202)'
return 0 return 0
} }
Write-Error 'SAC ingest agent.test: FAIL' Write-Error 'SAC ingest agent.test: FAIL'