80320ae698
fix: harden SAC security per audit (0.4.15)
...
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.
2026-07-07 19:32:12 +10:00
c72e510fb0
fix: defer daily report push и увеличить pool БД (0.4.12)
...
FCM/каналы для report.daily.* после commit ingest (BackgroundTasks);
SAC_DB_POOL_SIZE=15, SAC_DB_MAX_OVERFLOW=25 для штурма 09:00.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-06 12:00:37 +10:00
3765d4d476
feat: RDP flap auto-disconnect and hide break button after reconnect (0.4.10)
...
Add optional auto logoff of stuck sessions on RDG flap and direct RDP failure. Hide the RDS break button on old flap 302 when the user later reconnects or the workstation session is closed.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-02 16:50:03 +10:00
daeb7e965d
fix: skip alerts for hidden event types, show them on host card (0.4.7)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-29 15:16:10 +10:00
606bf53019
feat: close workstation login on RDG 303 disconnect (0.4.6)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-26 08:16:06 +10:00
0601aafd2d
fix: hide ????????? after session terminate (0.3.8)
...
Persist session_terminated in event details, expose in API, and update Events/Dashboard UI.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-24 14:45:33 +10:00
8b3e43f30d
fix: event terminate-session 500 on rdp.login.success (0.3.7)
...
Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-24 14:37:37 +10:00
1b96a3b2c7
fix: RDG event label and prefix type filter (0.3.2)
...
Use event 302/303 instead of Win302 in RDG titles. Match event types by prefix in events list (e.g. rdg.connection).
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-22 20:07:22 +10:00
d848d94604
feat: host session list/terminate and event session actions (0.20.28)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-22 10:13:42 +10:00
bf7c83c408
feat: hide event types from SAC UI via Settings checkbox (0.20.23)
...
Per-type «Показывать в событиях» in severity settings; filters lists, dashboard, hosts, and problems.
2026-06-21 20:13:40 +10:00
fc9d630263
docs: refresh README; allow monitor JWT for RDG qwinsta/logoff (0.20.6)
...
Update platform docs for current features; Seaca and web operators with
monitor role can trigger WinRM actions via SAC API.
2026-06-20 19:02:58 +10:00
01d72d0f68
fix: show RDG flap badge on 302 and 303 events in SAC UI (0.20.5)
...
Seaca surfaced flap via Problems; the web UI only flagged 303 in DB and had
no visible label. Resolve flap pairs at read time and show badge plus qwinsta
on both sides of 302→303.
2026-06-20 17:27:41 +10:00
75f4c475df
feat: RDG qwinsta/logoff via WinRM on client workstation (0.11.6)
...
SAC resolves internal_ip to a registered Windows host and runs qwinsta/logoff synchronously over WinRM instead of queueing commands to the gateway agent.
2026-06-20 15:36:12 +10:00
2aec488226
feat: RDG session flap rule, qwinsta/logoff queue and dashboard UI (0.9.13)
...
Detect 302→303 within 1–10s, Problem with 30s dedup, rdg_flap flag.
Agent command poll API, admin qwinsta/logoff from Overview. Migration 016.
2026-06-19 23:34:01 +10:00
77e167b6e3
feat: add actor user column to events and dashboard tables
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-10 10:11:04 +10:00
06a8ed8614
feat: events date filter and preserve list page in URL (SAC 0.7.1)
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-01 10:32:24 +10:00
de29270a25
feat: SAC 0.7.0 display_name columns and event severity overrides
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-01 10:21:43 +10:00
bc77f82307
feat: notify RD Gateway events in Telegram outside min_severity
...
Route rdg.connection.* through notify_rdg_connection and add disconnected type.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-01 08:14:37 +10:00
fbef1e2f4b
feat: always send RDP/SSH login success to Telegram via SAC
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-31 18:47:39 +10:00
366a9c83f7
feat: always notify agent.lifecycle via SAC with telegram_via routing
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-31 12:25:48 +10:00
415d863b3b
feat: SAC daily reports from DB aggregation (notif-32)
...
- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer
- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports
- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-29 16:30:07 +10:00
20fa7e2c27
feat: webhook notification channel with UI and ingest dispatch
...
Add webhook config (DB/env), JSON POST on events/problems, settings API,
Settings UI section, and notify_dispatch for multi-channel ingest.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-29 16:09:40 +10:00
79a78dc7c9
feat: Telegram settings in DB with UI edit and test send
...
Store notification_channels (migration 004), effective config DB over env,
PUT/test API endpoints, Settings form, and pass db session into ingest notify.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-29 16:05:32 +10:00
2b76ae8497
feat: ingest HTTP 201/409 for event_id idempotency
...
- Validate UUID format; log created/duplicate/rejected
- Tests for 201, 409, 422; update agent-integration and work-plan
- Docs: neutral IDE wording (no product-specific editor names)
2026-05-28 09:13:12 +10:00
eeba3a704d
feat: Telegram notifications from SAC on ingest
...
Send Telegram alerts for high/critical events and new Problems.
Configurable via TELEGRAM_* env vars; ingest never fails on send errors.
2026-05-27 12:21:03 +10:00
5fce00faae
feat: Problems API, ingest hook, and UI
2026-05-27 11:24:19 +10:00
bdfc7016e6
feat: phase 1C JWT UI, events/hosts API, Vue frontend
2026-05-26 21:46:34 +10:00
69a232d08a
feat: backend ingest API, Docker Compose, Ubuntu install guide
...
- FastAPI: POST /api/v1/events, GET /health, JSON Schema validation
- PostgreSQL models, Alembic migration, bootstrap API key
- deploy/docker-compose.yml, .env.example
- docs/install-ubuntu-24.04.md, updated work-plan (agents first)
2026-05-26 20:21:31 +10:00
PTah