PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: close rdp.login.success on rdp.session.logoff (v0.5.12)

Browse Source 
Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.
This commit is contained in:
PTah
2026-07-13 17:10:24 +10:00
parent 310e7f699d
commit 91be282ec6
15 changed files with 477 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/services/event_actor_user.py
+1
View File
@@ -15,6 +15,7 @@ ACTOR_USER_EVENT_TYPES: frozenset[str] = frozenset(
"session.logind.failed",
"rdp.login.success",
"rdp.login.failed",
"rdp.session.logoff",
"rdp.shadow.control.started",
"rdp.shadow.control.stopped",
"rdp.shadow.control.permission",