chore(private): sync production secrets and paths for papatramp mirror

Co-authored-by: Cursor <cursoragent@cursor.com>

login_monitor.settings.example.ps1

@@ -9,8 +9,8 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
-$TelegramChatID = '2843230'
+$TelegramBotToken = 'YOUR_BOT_TOKEN'
+$TelegramChatID = 'YOUR_CHAT_ID'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -29,17 +29,15 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '192.168.160.57'
+# $ServerIPv4 = '10.0.0.10'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.kalinamall.ru'
-$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
-$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
-$SacTimeoutSec = 45
-$SacSpoolFlushMaxFiles = 50
-$SacSpoolMaxAgeHours = 72
+$SacUrl = 'https://sac.example.com'
+$SacApiKey = 'sac_CHANGE_ME'
+# $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
+# $SacTimeoutSec = 12
 # $SacTlsSkipVerify = $false
 # $SacFallbackFailures = 5
 # $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
@@ -60,7 +58,6 @@ $StartupRebootDetectMinutes = 5
 $GetInventory = $true
 
 # --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
-# $EnableRcm1149Monitoring = 1            # RCM Operational 1149 (RDP auth; workstation + RDS server)
 # $EnableRcmShadowControlMonitoring = 1   # RCM Operational 20506/20507/20510
 # $EnableWinRmInboundMonitoring = 1       # WinRM Operational 91 (+ correlate Security 4624)
 # $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
@@ -72,7 +69,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '192.168.160.57'
+    '10.0.0.1'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -85,9 +82,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'K6A-DC3'
-$NetBiosDomainName = 'B26'
-$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
+$LockoutMonitorDomainController = 'DC01'
+$NetBiosDomainName = 'CONTOSO'
+$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30