PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
227 Commits 1 Branch 0 Tags
d47131cd9fd11525932e0c1d5b77fa819603aaaa
Commit Graph

101 Commits

Author SHA1 Message Date
PTah 2aec488226 feat: RDG session flap rule, qwinsta/logoff queue and dashboard UI (0.9.13) 
Detect 302→303 within 1–10s, Problem with 30s dedup, rdg_flap flag.
Agent command poll API, admin qwinsta/logoff from Overview. Migration 016.
 2026-06-19 23:34:01 +10:00
PTah 55f047cd35 fix: Seaca push uses same lifecycle text as Telegram (0.9.11) 
Reuse telegram templates for FCM title/body so agent start/restart
reasons reach mobile without Seaca app changes.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-17 11:35:17 +10:00
Andrey Lutsenko 3d36faa49d fix(mobile): повторный enroll и удаление устройств в UI (0.9.10). 
При повторной привязке Seaca переиспользуется запись device_uuid вместо INSERT.
Добавлены POST /devices/{id}/revoke и DELETE для полного удаления записи в настройках SAC.
 2026-06-13 16:36:07 +10:00
PTah 7df718eed3 fix: 12h cooldown before reopening manually closed host_silence (0.9.9) 
Track resolved_by on problems; suppress scan/ingest recreate after manual
resolve; reopen same problem after cooldown; auto-close via heartbeat unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 10:33:55 +10:00
PTah 3f671b9899 fix: FCM data-only push so Seaca controls sound (0.9.6) 
Send title and body in the data payload instead of notification block so
onMessageReceived always runs and the app can honour silent mode in background.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 10:03:28 +10:00
PTah 3f7095ed03 fix: host_silence proactive notify when event is None 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-11 09:26:03 +10:00
PTah e38bd8a52a fix: FCM must not break ingest; add requests dependency (0.9.3) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 17:30:32 +10:00
PTah f9baf96d88 fix: test push errors, skip heartbeat notify, stale 5h (0.9.2) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 17:25:16 +10:00
PTah 563b836acc feat: Seaca mobile API, enrollment, FCM push and admin UI (0.9.0) 
Adds mobile device registration by admin codes, refresh tokens, push channel
in notification policy, and Settings section for managing Seaca clients.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 13:19:14 +10:00
PTah 77e167b6e3 feat: add actor user column to events and dashboard tables 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 10:11:04 +10:00
PTah f9d56621f6 feat: drill-down filters on overview and outdated agent version highlight 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 09:21:21 +10:00
PTah aafb80fa31 feat: proactive host_silence scan for stale agent.heartbeat (0.8.3) 
Background scan every 5 min opens rule:host_silence and notifies without
waiting for the next ingest event. CLI job + optional systemd timer.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 09:07:32 +10:00
PTah 54337a5917 feat: host inventory (agent.inventory), host detail page, UI columns 
Store hardware/software snapshots on hosts; warn on hardware changes. Host card from Hosts list. Add agent version column to Events/Overview; rename Hosts table columns and sort by status.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 09:53:00 +10:00
PTah 57793d24ba feat: SAC support smb.admin_share.access events from RDP agent 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:14:14 +10:00
PTah 79185d9186 fix: show RD Gateway session duration in Telegram when present 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 10:07:51 +10:00
PTah 0d4a50cd35 fix: dedupe daily report Telegram in dual mode and show host in summary fallback 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 09:15:21 +10:00
PTah 3053058cdf feat: SAC 0.7.4 sidebar system stats block with UI toggle 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-02 09:15:15 +10:00
PTah d3a337992c feat: SAC 0.7.2 security hardening (rate limit, JWT DB check, DOMPurify) 
Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 11:04:14 +10:00
PTah de29270a25 feat: SAC 0.7.0 display_name columns and event severity overrides 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 10:21:43 +10:00
PTah 56c469ddbd feat: multi-user UI login with admin and monitor roles 
Add sac_users table, JWT roles, settings/users API guarded for admin, Users page in UI, and sac_manage_user.py CLI.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:27:14 +10:00
PTah bc77f82307 feat: notify RD Gateway events in Telegram outside min_severity 
Route rdg.connection.* through notify_rdg_connection and add disconnected type.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 08:14:37 +10:00
PTah 7e13be3c38 fix: hide redundant RDP workstation line when it matches server host 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:55:11 +10:00
PTah fbef1e2f4b feat: always send RDP/SSH login success to Telegram via SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:47:39 +10:00
PTah 4baa2b426f feat: render full agent lifecycle text from notification_body in Telegram 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:11:17 +10:00
PTah 9dacbd7944 fix: Telegram footer shows SAC as sender when SAC delivers the message 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 12:41:23 +10:00
PTah 366a9c83f7 feat: always notify agent.lifecycle via SAC with telegram_via routing 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 12:25:48 +10:00
PTah 3d4d1f3c76 feat: show notification source (agent vs SAC) in alerts and reports 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:51:53 +10:00
PTah a45b641b8c feat: daily report agent version line and fix active users layout 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:28:30 +10:00
PTah 799f8668e6 feat: Telegram templates for RDS shadow and WinRM session events 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:20:57 +10:00
PTah 2501ecc4fe fix: normalize daily report layout for Telegram and UI 
Ensure server line, compact spacing, and one user per row when ingesting
agent reports or sending SAC-generated daily reports.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 09:52:09 +10:00
PTah 7ebbb9a9d1 feat: unify SSH and Windows daily report layout in SAC and UI 
Agent-style report body for SAC aggregation; shared stats cards; RDP ban note in docs

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 17:03:29 +10:00
PTah 11195ae64f feat: delete host from UI with events and problems cleanup 
DELETE /api/v1/hosts/{id} (JWT); host reappears on next agent ingest

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:52:05 +10:00
PTah 2670c8cb46 fix: sanitize daily report HTML for Telegram parse_mode 
Strip div/br tags unsupported by Telegram API; reports still store UI HTML in details

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:35:04 +10:00
PTah 42f31b3bb5 fix: dashboard and hosts count SSH and RDP daily reports 
analytics-a4: daily_reports_24h uses report.daily.*; sac-deploy enables timers
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:31:09 +10:00
PTah 415d863b3b feat: SAC daily reports from DB aggregation (notif-32) 
- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer

- notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports

- HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases)

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:30:07 +10:00
PTah 4167687dec feat: notification cooldown dedup for events and problems (notif-31) 
Store last notify time by dedup_key/fingerprint, gate dispatch before
channels; config SAC_NOTIFY_*_COOLDOWN_SEC, migration 008.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:24:01 +10:00
PTah 1a70980920 feat: HTML Telegram templates for RDP/SSH events (notif-30) 
Agent-style messages from event details, parse_mode HTML, templates for
login/sudo/RDG and problems; unit tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:21:40 +10:00
PTah ebb450be92 feat: global notification policy severity to channels (notif-22) 
Singleton notification_policy table, NOTIFY_MIN_SEVERITY/CHANNELS env,
central dispatch gate, Settings policy UI, migration 007.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:19:26 +10:00
PTah 9b177c145b feat: SMTP email notification channel with UI and ingest 
Migration 006, email config DB/env, smtplib sender, settings API,
Settings UI section, and dispatch on event/problem ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:12:55 +10:00
PTah 20fa7e2c27 feat: webhook notification channel with UI and ingest dispatch 
Add webhook config (DB/env), JSON POST on events/problems, settings API,
Settings UI section, and notify_dispatch for multi-channel ingest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:09:40 +10:00
PTah 79a78dc7c9 feat: Telegram settings in DB with UI edit and test send 
Store notification_channels (migration 004), effective config DB over env,
PUT/test API endpoints, Settings form, and pass db session into ingest notify.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 16:05:32 +10:00
PTah e0ba384705 feat: SAC Telegram settings view, notify_problem severity gate, exclusive docs 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-29 15:58:08 +10:00
PTah d4bf6e536c feat: host display_name в ingest, поиск хостов, UI и docs 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:49:10 +10:00
PTah 108e1756c4 feat: live последние события на Dashboard; retention, health, runbook 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 11:29:31 +10:00
PTah 64b5ef297a feat: problem rules v1 brute-force, privilege spike, host silence (d1-3) 
- Threshold rules on ingest; heartbeat auto-resolves host silence

- Config thresholds in sac-api.env; unit tests

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 09:51:05 +10:00
PTah a4a224b284 feat: Problems correlation fingerprint, count, last_seen (d1-2) 
- Migration 003; windowed host+type+rule correlation on ingest

- GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard

- Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 09:46:12 +10:00
PTah 2b76ae8497 feat: ingest HTTP 201/409 for event_id idempotency 
- Validate UUID format; log created/duplicate/rejected

- Tests for 201, 409, 422; update agent-integration and work-plan

- Docs: neutral IDE wording (no product-specific editor names)
 2026-05-28 09:13:12 +10:00
PTah 04301ab359 feat: host heartbeat status and dashboard metrics (2.2) 
Track agent.heartbeat and report.daily.ssh per host; show online/stale
on Hosts UI; dashboard counters and SAC_HEARTBEAT_STALE_MINUTES config.
 2026-05-27 13:36:17 +10:00
PTah eeba3a704d feat: Telegram notifications from SAC on ingest 
Send Telegram alerts for high/critical events and new Problems.
Configurable via TELEGRAM_* env vars; ingest never fails on send errors.
 2026-05-27 12:21:03 +10:00
PTah 5fce00faae feat: Problems API, ingest hook, and UI 2026-05-27 11:24:19 +10:00