feat: add actor user column to events and dashboard tables

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/events.py

@@ -179,19 +179,9 @@ def get_event(
     )
     if event is None:
         raise HTTPException(status_code=404, detail="Event not found")
+    base = event_to_summary(event)
     return EventDetail(
-        id=event.id,
-        event_id=event.event_id,
-        host_id=event.host_id,
-        hostname=event.host.hostname,
-        display_name=event.host.display_name,
-        occurred_at=event.occurred_at,
-        received_at=event.received_at,
-        category=event.category,
-        type=event.type,
-        severity=event.severity,
-        title=event.title,
-        summary=event.summary,
+        **base.model_dump(),
         details=event.details,
         raw=event.raw,
         dedup_key=event.dedup_key,

backend/app/schemas/list_models.py

@@ -54,6 +54,7 @@ class EventSummary(BaseModel):
     severity: str
     title: str
     summary: str
+    actor_user: str | None = None
 
     model_config = {"from_attributes": True}
 

backend/app/services/event_actor_user.py

@@ -0,0 +1,49 @@
+"""Имя пользователя для событий подключения/аутентификации (колонка «Пользователь» в UI)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+# События, где в details может быть учётная запись (SSH/RDP/sudo/logind и т.д.).
+ACTOR_USER_EVENT_TYPES: frozenset[str] = frozenset(
+    {
+        "ssh.login.success",
+        "ssh.login.failed",
+        "privilege.sudo.command",
+        "session.logind.new",
+        "session.logind.removed",
+        "session.logind.failed",
+        "rdp.login.success",
+        "rdp.login.failed",
+        "rdp.shadow.control.started",
+        "rdp.shadow.control.stopped",
+        "rdp.shadow.control.permission",
+        "winrm.session.started",
+        "smb.admin_share.access",
+        "auth.explicit.credentials",
+        "rdg.connection.success",
+        "rdg.connection.disconnected",
+        "rdg.connection.failed",
+    }
+)
+
+_SHADOW_DETAIL_KEYS = ("shadower_user", "user", "username")
+_DEFAULT_DETAIL_KEYS = ("user", "username")
+
+
+def _pick_detail_value(details: dict[str, Any], keys: tuple[str, ...]) -> str | None:
+    for key in keys:
+        val = details.get(key)
+        if val is not None and str(val).strip() not in ("", "-"):
+            return str(val).strip()
+    return None
+
+
+def extract_event_actor_user(event_type: str, details: dict[str, Any] | None) -> str | None:
+    """Вернуть имя пользователя для auth/connect событий или None (UI покажет «—»)."""
+    if event_type not in ACTOR_USER_EVENT_TYPES:
+        return None
+    if not isinstance(details, dict):
+        return None
+    keys = _SHADOW_DETAIL_KEYS if event_type.startswith("rdp.shadow.") else _DEFAULT_DETAIL_KEYS
+    return _pick_detail_value(details, keys)

backend/app/services/event_summary.py

@@ -1,5 +1,6 @@
 from app.models.event import Event
 from app.schemas.list_models import EventSummary
+from app.services.event_actor_user import extract_event_actor_user
 
 
 def event_to_summary(event: Event) -> EventSummary:
@@ -18,4 +19,5 @@ def event_to_summary(event: Event) -> EventSummary:
         severity=event.severity,
         title=event.title,
         summary=event.summary,
+        actor_user=extract_event_actor_user(event.type, event.details),
     )