feat: persistent Security poll cursor with lookback replay (2.0.36-SAC)

Save last_security_poll.txt between runs and replay Security events up to SecurityEventsLookbackMinutes on startup so slow boot or late agent start does not miss RDP/WinRM-related logons. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-16 09:39:43 +10:00
parent d5db38e2ae
commit f48aee1d93
4 changed files with 102 additions and 3 deletions
@@ -15,6 +15,7 @@ $suites = @(
    'Test-ScriptSyntaxAll.ps1',
    'Test-TaskQueryModule.ps1',
    'Test-DeployTaskLimit.ps1',
+    'Test-SecurityPollCursor.ps1',
    'Test-SendDeploySacNotice.ps1'
 )