feat: SAC support smb.admin_share.access events from RDP agent

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -29,10 +29,10 @@
 События приходят от агентов по [контракту ingest](docs/agent-integration.md) (`type`, `severity`, `details`):
 
 - **Linux — [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor):** SSH (успех/неудача), **sudo**, **systemd-logind** (сессии), брутфорс и баны IP (ipset), пороги без бана, ежедневный отчёт, heartbeat.
-- **Windows — [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor):** **RDP/RDS** (4624/4625), **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession, WinRM Operational ID 91), **RDP Shadow Control** (RCM 20506/20507/20510), явные учётные данные (4648), блокировка учётки (4740), брутфорс 4625, отчёт, heartbeat.
+- **Windows — [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor):** **RDP/RDS** (4624/4625), **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession), **admin share C$/ADMIN$** (5140), **RDP Shadow Control** (RCM), блокировка учётки (4740), отчёт, heartbeat.
 - **В самом SAC:** корреляция **problems**, уведомления Telegram/email/webhook, лимит попыток входа в UI, SSE-дашборд.
 
-Примеры типов: `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `rdp.shadow.control.*`, `rdg.connection.*`, `agent.heartbeat` — полная таблица в [docs/agent-integration.md §3](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий).
+Примеры типов: `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `smb.admin_share.access`, `rdp.shadow.control.*`, `rdg.connection.*`, `agent.heartbeat` — полная таблица в [docs/agent-integration.md §3](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий).
 
 ### Текущее состояние (июнь 2026)
 

backend/app/constants/event_types.py

@@ -26,6 +26,7 @@ DEFAULT_EVENT_SEVERITIES: dict[str, str] = {
     "rdp.shadow.control.stopped": "info",
     "rdp.shadow.control.permission": "warning",
     "winrm.session.started": "warning",
+    "smb.admin_share.access": "warning",
     "auth.explicit.credentials": "warning",
     "report.daily.rdp": "info",
     "rdp.ip.banned": "high",

backend/app/services/telegram_templates.py

@@ -309,6 +309,30 @@ def format_winrm_session_html(event: Event) -> str:
     return msg.rstrip()
 
 
+def format_smb_admin_share_html(event: Event) -> str:
+    details = _details_dict(event)
+    msg = "<b>📁 Доступ к админ-шару (5140)</b>\n"
+    msg += _line("🏢", "Сервер", host_label(event.host))
+    msg += _line("👤", "Пользователь", html_escape(_detail(details, "user", "username")))
+    ip = _detail(details, "source_ip", "ip_address", "ip")
+    if ip != "-":
+        msg += _line("🌐", "IP клиента", html_escape(ip))
+    share = _detail(details, "share_name", default="")
+    if share != "-":
+        msg += _line("📂", "Share", html_escape(share))
+    path = _detail(details, "share_path", default="")
+    if path != "-":
+        msg += _line("📍", "Путь", html_escape(path))
+    target = _detail(details, "relative_target", default="")
+    if target != "-":
+        msg += _line("📄", "Объект", html_escape(target))
+    msg += _line("🕐", "Время", format_time(event.occurred_at))
+    win_id = _detail(details, "event_id_windows", default="")
+    if win_id != "-":
+        msg += f"🔢 Event ID: {html_escape(win_id)} (File Share)"
+    return msg.rstrip()
+
+
 def format_generic_event_html(event: Event) -> str:
     sev = event.severity.upper()
     msg = f"<b>🚨 SAC: {html_escape(event.title)}</b>\n"
@@ -427,6 +451,8 @@ def _format_event_body_html(event: Event) -> str:
         return format_rdp_shadow_html(event)
     if event.type.startswith("winrm."):
         return format_winrm_session_html(event)
+    if event.type.startswith("smb."):
+        return format_smb_admin_share_html(event)
     return format_generic_event_html(event)
 
 
@@ -480,6 +506,7 @@ def format_problem_telegram_html(problem: Problem, event: Event | None = None) -
             "rdp.shadow.control.stopped",
             "rdp.shadow.control.permission",
             "winrm.session.started",
+            "smb.admin_share.access",
         ):
             msg += "\n" + _format_event_body_html(event)
     return append_notification_source_html(msg, generated_by="sac")

docs/agent-integration.md

@@ -187,6 +187,7 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 | RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
 | WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |
 | Security **5140** admin share (`C$`, `ADMIN$`) | `smb.admin_share.access` | **warning** |
+| 4648 | `auth.explicit.credentials` | warning |
 | RD Gateway 302 | `rdg.connection.success` | info |
 | RD Gateway 303 | `rdg.connection.failed` | warning |
 | Старт/стоп | `agent.lifecycle` | info |
@@ -198,10 +199,11 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 - Shadow: `shadower_user`, `target_user`, `session_id`, `shadow_mode`, `shadow_action`
 - WinRM: `source_ip`, `resource_uri`, `transport`
 - Admin share 5140: `share_name`, `share_path`, `relative_target`, `access_mask`
+- `gateway_target`, `gateway_error_code`
 - `filtered_out`, `filter_reason`
 
 **Переключатели в `login_monitor.settings.ps1` (≥ 1.2.23-SAC):** `$EnableRcmShadowControlMonitoring`, `$EnableWinRmInboundMonitoring`, `$EnableAdminShareMonitoring` (по умолчанию `1`; Security **5140**, audit File Share). Подавление: `ignore.lst` с префиксами `shadow:`, `winrm:`, `smb:` / `5140:`.
-
+
 ---
 
 ## 3.3. Человекочитаемое имя хоста (`host.display_name`)

docs/event-schema-v1.json

@@ -98,6 +98,7 @@
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",
         "winrm.session.started",
+        "smb.admin_share.access",
         "rdg.connection.success",
         "report.daily.ssh",
         "agent.heartbeat",

schemas/event-schema-v1.json

@@ -98,6 +98,7 @@
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",
         "winrm.session.started",
+        "smb.admin_share.access",
         "rdg.connection.success",
         "rdg.connection.disconnected",
         "rdg.connection.failed",