PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Browse Source 
Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.
This commit is contained in:
PTah
2026-07-13 17:10:24 +10:00
parent 310e7f699d
commit 91be282ec6
15 changed files with 477 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/agent-integration.md
+1
View File
@@ -185,6 +185,7 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
| 4624 успех | `rdp.login.success` | info |
| 4625 неудача | `rdp.login.failed` | warning |
| 4634 / 4647 выход (прямой RDP) | `rdp.session.logoff` | info |
| RCM **20506** Shadow Control started | `rdp.shadow.control.started` | **warning** |
| RCM **20507** Shadow Control stopped | `rdp.shadow.control.stopped` | **warning** |
| RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
| WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |