feat: Telegram templates for RDS shadow and WinRM session events

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-30 10:20:57 +10:00
parent 2501ecc4fe
commit 799f8668e6
5 changed files with 126 additions and 1 deletions
@@ -67,6 +67,60 @@ def test_rdp_success_template():
    assert "Сеть/RDP" in text


+def test_rdp_shadow_control_template():
+    host = Host(hostname="RDS01", display_name="RDS Farm", ipv4="10.0.0.5", os_family="windows")
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000701",
+        host_id=1,
+        host=host,
+        occurred_at=datetime(2026, 5, 30, 10, 0, 0, tzinfo=timezone.utc),
+        category="session",
+        type="rdp.shadow.control.started",
+        severity="warning",
+        title="RDS Shadow Control 20506",
+        summary="Shadow admin -> user",
+        details={
+            "event_id_windows": 20506,
+            "shadower_user": "DOMAIN\\admin",
+            "target_user": "DOMAIN\\user",
+            "session_id": "3",
+            "shadow_action": "control_started",
+        },
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "SHADOW CONTROL" in text
+    assert "DOMAIN" in text
+    assert "20506" in text
+    assert "RDS Farm" in text
+
+
+def test_winrm_session_template():
+    host = Host(hostname="SRV01", display_name="App Server", os_family="windows")
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000702",
+        host_id=1,
+        host=host,
+        occurred_at=datetime(2026, 5, 30, 11, 0, 0, tzinfo=timezone.utc),
+        category="session",
+        type="winrm.session.started",
+        severity="warning",
+        title="WinRM shell",
+        summary="WinRM 91",
+        details={
+            "event_id_windows": 91,
+            "user": "DOMAIN\\admin",
+            "source_ip": "192.168.160.3",
+            "resource_uri": "http://schemas.microsoft.com/powershell/Microsoft.PowerShell",
+        },
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "Enter-PSSession" in text or "WinRM" in text
+    assert "192.168.160.3" in text
+    assert "91" in text
+
+
 def test_ssh_failed_template():
    event = Event(
        event_id="00000000-0000-4000-8000-000000000503",