3 Commits

Author	SHA1	Message	Date
PTah	52125a5a98	fix: enrich empty rdp.login.success user from RDG 302 (0.5.15) ... RCM 1149 often leaves Param1/Param2 empty through RD Gateway; backfill details.user from matching RDG success within 5 minutes, and still close empty-user sessions on RDG end.	2026-07-14 10:47:10 +10:00
PTah	91be282ec6	feat: close rdp.login.success on rdp.session.logoff (v0.5.12) ... Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.	2026-07-13 17:10:24 +10:00
PTah	606bf53019	feat: close workstation login on RDG 303 disconnect (0.4.6) ... Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-26 08:16:06 +10:00