feat: SAC support smb.admin_share.access events from RDP agent

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/telegram_templates.py

@@ -309,6 +309,30 @@ def format_winrm_session_html(event: Event) -> str:
     return msg.rstrip()
 
 
+def format_smb_admin_share_html(event: Event) -> str:
+    details = _details_dict(event)
+    msg = "<b>📁 Доступ к админ-шару (5140)</b>\n"
+    msg += _line("🏢", "Сервер", host_label(event.host))
+    msg += _line("👤", "Пользователь", html_escape(_detail(details, "user", "username")))
+    ip = _detail(details, "source_ip", "ip_address", "ip")
+    if ip != "-":
+        msg += _line("🌐", "IP клиента", html_escape(ip))
+    share = _detail(details, "share_name", default="")
+    if share != "-":
+        msg += _line("📂", "Share", html_escape(share))
+    path = _detail(details, "share_path", default="")
+    if path != "-":
+        msg += _line("📍", "Путь", html_escape(path))
+    target = _detail(details, "relative_target", default="")
+    if target != "-":
+        msg += _line("📄", "Объект", html_escape(target))
+    msg += _line("🕐", "Время", format_time(event.occurred_at))
+    win_id = _detail(details, "event_id_windows", default="")
+    if win_id != "-":
+        msg += f"🔢 Event ID: {html_escape(win_id)} (File Share)"
+    return msg.rstrip()
+
+
 def format_generic_event_html(event: Event) -> str:
     sev = event.severity.upper()
     msg = f"<b>🚨 SAC: {html_escape(event.title)}</b>\n"
@@ -427,6 +451,8 @@ def _format_event_body_html(event: Event) -> str:
         return format_rdp_shadow_html(event)
     if event.type.startswith("winrm."):
         return format_winrm_session_html(event)
+    if event.type.startswith("smb."):
+        return format_smb_admin_share_html(event)
     return format_generic_event_html(event)
 
 
@@ -480,6 +506,7 @@ def format_problem_telegram_html(problem: Problem, event: Event | None = None) -
             "rdp.shadow.control.stopped",
             "rdp.shadow.control.permission",
             "winrm.session.started",
+            "smb.admin_share.access",
         ):
             msg += "\n" + _format_event_body_html(event)
     return append_notification_source_html(msg, generated_by="sac")