feat: SAC agent command poll qwinsta/logoff (2.0.39-SAC)

Poll GET /api/v1/agent/commands every SacCommandPollIntervalSec;
execute qwinsta/logoff with run_as from SAC; POST result.
This commit is contained in:
2026-06-19 23:37:58 +10:00
parent afa80d169f
commit 6f08af7365
4 changed files with 236 additions and 3 deletions
+2
View File
@@ -46,6 +46,8 @@ $DailyReportEnabled = 1
# --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
$HeartbeatInterval = 14400
# Poll SAC на команды qwinsta/logoff (сек); см. security-alert-center/docs/agent-control-plane.md
# $SacCommandPollIntervalSec = 60
# Окно (мин): LastBootUpTime + System 41/1074/6005/6008/6009 → «старт после перезагрузки ОС»
$StartupRebootDetectMinutes = 5