feat: SAC support smb.admin_share.access events from RDP agent

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-04 10:14:14 +10:00
parent d324e41eba
commit 57793d24ba
6 changed files with 35 additions and 3 deletions
@@ -26,6 +26,7 @@ DEFAULT_EVENT_SEVERITIES: dict[str, str] = {
    "rdp.shadow.control.stopped": "info",
    "rdp.shadow.control.permission": "warning",
    "winrm.session.started": "warning",
+    "smb.admin_share.access": "warning",
    "auth.explicit.credentials": "warning",
    "report.daily.rdp": "info",
    "rdp.ip.banned": "high",