fix: hide redundant RDP workstation line when it matches server host

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
2026-05-31 18:55:11 +10:00
parent fbef1e2f4b
commit 7e13be3c38
2 changed files with 87 additions and 2 deletions
+29 -2
View File
@@ -82,6 +82,31 @@ def host_label(host: Host | None, *, fallback: str = "unknown") -> str:
return html_escape(host.hostname)
def _host_display_name_base(display_name: str | None) -> str:
if not display_name or not display_name.strip():
return ""
return display_name.strip().split("(", 1)[0].strip()
def _rdp_workstation_is_redundant(workstation: str, host: Host | None) -> bool:
"""Скрыть Workstation Name, если пусто/«-» или совпадает с hostname/display_name сервера."""
ws = (workstation or "").strip()
if not ws or ws in ("-", "N/A", "?"):
return True
if host is None:
return False
ws_key = ws.casefold()
if host.hostname and ws_key == host.hostname.strip().casefold():
return True
dn = (host.display_name or "").strip()
if dn and ws_key == dn.casefold():
return True
base = _host_display_name_base(host.display_name)
if base and ws_key == base.casefold():
return True
return False
def format_time(dt: datetime | None) -> str:
if dt is None:
return "-"
@@ -175,14 +200,16 @@ def format_rdp_login_html(event: Event) -> str:
user = html_escape(_detail(details, "user", "username"))
ip = html_escape(_detail(details, "ip_address", "source_ip", "ip"))
workstation = html_escape(_detail(details, "workstation_name", "computer_name"))
workstation_raw = _detail(details, "workstation_name", "computer_name")
workstation = html_escape(workstation_raw)
process = html_escape(_detail(details, "process_name", "process", default=""))
logon = logon_type_label(details.get("logon_type"))
msg = f"<b>{header}</b>\n"
msg += _line("👤", "Пользователь", user)
msg += _line("🏢", "Сервер", host_label(event.host))
msg += _line("🖥️", "Рабочая станция", workstation)
if not _rdp_workstation_is_redundant(workstation_raw, event.host):
msg += _line("🖥️", "Рабочая станция", workstation)
msg += _line("🌐", "IP адрес", ip)
if process and process != "-":
msg += _line("⚙️", "Процесс", process)
+58
View File
@@ -49,6 +49,64 @@ def test_rdp_failed_template_includes_user_ip_logon():
assert "<b>" in text
def test_rdp_login_hides_redundant_workstation_when_matches_hostname():
host = Host(
hostname="ITIS198",
display_name="ITIS (192.168.160.198)",
os_family="windows",
)
event = Event(
event_id="00000000-0000-4000-8000-000000000508",
host_id=1,
host=host,
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
category="auth",
type="rdp.login.success",
severity="info",
title="RDP login",
summary="papatramp",
details={
"user": "papatramp",
"ip_address": "192.168.160.3",
"logon_type": 10,
"workstation_name": "ITIS198",
"event_id_windows": 4624,
},
payload={},
)
text = format_rdp_login_html(event)
assert "ITIS" in text
assert "192.168.160.3" in text
assert "Рабочая станция" not in text
assert "ITIS198" not in text
def test_rdp_login_shows_workstation_when_client_differs():
host = Host(hostname="ITIS198", display_name="ITIS", os_family="windows")
event = Event(
event_id="00000000-0000-4000-8000-000000000509",
host_id=1,
host=host,
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
category="auth",
type="rdp.login.success",
severity="info",
title="RDP login",
summary="papatramp",
details={
"user": "papatramp",
"ip_address": "192.168.160.3",
"logon_type": 10,
"workstation_name": "NEW-ADMIN-PC",
"event_id_windows": 4624,
},
payload={},
)
text = format_rdp_login_html(event)
assert "Рабочая станция" in text
assert "NEW-ADMIN-PC" in text
def test_rdp_success_template():
event = Event(
event_id="00000000-0000-4000-8000-000000000502",