feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.
2026-07-13 17:10:24 +10:00
parent 310e7f699d
commit 91be282ec6
15 changed files with 477 additions and 7 deletions
@@ -23,6 +23,7 @@ DEFAULT_EVENT_SEVERITIES: dict[str, str] = {
    # RDP / Windows
    "rdp.login.success": "info",
    "rdp.login.failed": "warning",
+    "rdp.session.logoff": "info",
    "rdp.shadow.control.started": "warning",
    "rdp.shadow.control.stopped": "info",
    "rdp.shadow.control.permission": "warning",