fix: filter WinRM noise (HealthMailbox, machine accounts, loopback)

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-30 10:31:30 +10:00
parent 1ff8dd1a95
commit b010ad01eb
3 changed files with 74 additions and 6 deletions
@@ -48,7 +48,9 @@ $DailyReportEnabled = 1
 # --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
 # $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
 # $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
-# $WinRmCorrelateSecurity4624 = 1
+# $WinRmIgnoreLocalSource = 1             # ::1, 127.0.0.1, fe80 (шум Exchange/локальный WinRM)
+# $WinRmIgnoreMachineAccounts = 1         # учётки, оканчивающиеся на $
+# HealthMailbox* уже в ExcludedUserPatterns скрипта
 # Проверка: powershell -File Login_Monitor.ps1 -CheckSac

 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---