feat: Telegram templates for RDS shadow and WinRM session events

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/telegram_templates.py

@@ -168,6 +168,48 @@ def format_sudo_html(event: Event) -> str:
     return msg.rstrip()
 
 
+def format_rdp_shadow_html(event: Event) -> str:
+    details = _details_dict(event)
+    action = _detail(details, "shadow_action", default="")
+    if action == "control_stopped" or event.type.endswith(".stopped"):
+        header = "🎭 RDS SHADOW CONTROL — остановлено"
+    elif action == "control_permission" or event.type.endswith(".permission"):
+        header = "🎭 RDS SHADOW CONTROL — разрешение"
+    else:
+        header = "🎭 RDS SHADOW CONTROL — начато"
+
+    msg = f"<b>{header}</b>\n"
+    msg += _line("🏢", "Сервер", host_label(event.host))
+    msg += _line("👤", "Администратор", html_escape(_detail(details, "shadower_user", "user")))
+    msg += _line("🎯", "Сессия пользователя", html_escape(_detail(details, "target_user", default="-")))
+    sid = _detail(details, "session_id", "target_session_id", default="")
+    if sid != "-":
+        msg += _line("🔢", "Session ID", html_escape(sid))
+    msg += _line("🕐", "Время", format_time(event.occurred_at))
+    win_id = _detail(details, "event_id_windows", default="")
+    if win_id != "-":
+        msg += f"🔢 Event ID: {html_escape(win_id)} (RemoteConnectionManager)"
+    return msg.rstrip()
+
+
+def format_winrm_session_html(event: Event) -> str:
+    details = _details_dict(event)
+    msg = "<b>⚠️ WinRM / Enter-PSSession — удалённая shell</b>\n"
+    msg += _line("🏢", "Сервер", host_label(event.host))
+    msg += _line("👤", "Пользователь", html_escape(_detail(details, "user", "username")))
+    ip = _detail(details, "source_ip", "ip_address", "ip")
+    if ip != "-":
+        msg += _line("🌐", "IP источника", html_escape(ip))
+    uri = _detail(details, "resource_uri", default="")
+    if uri != "-":
+        msg += _line("🔗", "ResourceUri", html_escape(uri))
+    msg += _line("🕐", "Время", format_time(event.occurred_at))
+    win_id = _detail(details, "event_id_windows", default="")
+    if win_id != "-":
+        msg += f"🔢 Event ID: {html_escape(win_id)} (WinRM Operational)"
+    return msg.rstrip()
+
+
 def format_generic_event_html(event: Event) -> str:
     sev = event.severity.upper()
     msg = f"<b>🚨 SAC: {html_escape(event.title)}</b>\n"
@@ -216,6 +258,10 @@ def format_event_telegram_html(event: Event) -> str:
         return format_sudo_html(event)
     if event.type.startswith("rdg."):
         return _format_rdg_html(event)
+    if event.type.startswith("rdp.shadow."):
+        return format_rdp_shadow_html(event)
+    if event.type.startswith("winrm."):
+        return format_winrm_session_html(event)
     return format_generic_event_html(event)
 
 
@@ -249,6 +295,15 @@ def format_problem_telegram_html(problem: Problem, event: Event | None = None) -
     msg += f"\n<b>{html_escape(problem.title)}</b>\n{html_escape(problem.summary)}"
     if event is not None:
         msg += f"\n\n<i>Триггер:</i> {html_escape(event.type)} ({html_escape(event.severity)})"
-        if event.type in ("rdp.login.success", "rdp.login.failed", "ssh.login.success", "ssh.login.failed"):
+        if event.type in (
+            "rdp.login.success",
+            "rdp.login.failed",
+            "ssh.login.success",
+            "ssh.login.failed",
+            "rdp.shadow.control.started",
+            "rdp.shadow.control.stopped",
+            "rdp.shadow.control.permission",
+            "winrm.session.started",
+        ):
             msg += "\n" + format_event_telegram_html(event)
     return msg.rstrip()