feat: SAC 0.7.0 display_name columns and event severity overrides

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-01 10:21:43 +10:00
parent 8de5d14cfb
commit de29270a25
25 changed files with 850 additions and 222 deletions
@@ -0,0 +1,37 @@
+"""Known SAC event types and default severities from agents (schema v1 / agent-integration)."""
+
+from __future__ import annotations
+
+DEFAULT_EVENT_SEVERITIES: dict[str, str] = {
+    # Agent / lifecycle
+    "agent.heartbeat": "info",
+    "agent.lifecycle": "info",
+    "agent.test": "info",
+    "agent.recovered": "info",
+    # SSH
+    "ssh.login.success": "info",
+    "ssh.login.failed": "warning",
+    "ssh.ip.banned": "high",
+    "ssh.ip.bruteforce.threshold": "warning",
+    "ssh.bruteforce.mass": "high",
+    "privilege.sudo.command": "warning",
+    "session.logind.new": "info",
+    "session.logind.removed": "info",
+    "session.logind.failed": "warning",
+    "report.daily.ssh": "info",
+    # RDP / Windows
+    "rdp.login.success": "info",
+    "rdp.login.failed": "warning",
+    "rdp.shadow.control.started": "warning",
+    "rdp.shadow.control.stopped": "info",
+    "rdp.shadow.control.permission": "warning",
+    "winrm.session.started": "warning",
+    "auth.explicit.credentials": "warning",
+    "report.daily.rdp": "info",
+    "rdp.ip.banned": "high",
+    "rdp.ip.ban": "high",
+    # RD Gateway
+    "rdg.connection.success": "info",
+    "rdg.connection.disconnected": "info",
+    "rdg.connection.failed": "warning",
+}