feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 17:07:04 +10:00
parent 310e7f699d
commit e38f62340f
15 changed files with 477 additions and 7 deletions
@@ -94,6 +94,7 @@
        "session.logind.new",
        "rdp.login.success",
        "rdp.login.failed",
+        "rdp.session.logoff",
        "rdp.shadow.control.started",
        "rdp.shadow.control.stopped",
        "rdp.shadow.control.permission",