feat: map security events to SAC typed payloads

sac-client.sh

@@ -99,6 +99,19 @@ def details():
     return json.loads(raw)
 
 host = socket.gethostname()
+etype = os.environ["SAC_EVENT_TYPE"]
+if etype.startswith(("ssh.", "auth.", "rdp.")):
+    category = "auth"
+elif etype.startswith("privilege."):
+    category = "privilege"
+elif etype.startswith("session."):
+    category = "session"
+elif etype.startswith("report."):
+    category = "report"
+elif etype.startswith("rdg."):
+    category = "network"
+else:
+    category = "agent"
 payload = {
     "schema_version": "1.0",
     "event_id": str(uuid.uuid4()),
@@ -112,7 +125,7 @@ payload = {
         "hostname": host,
         "os_family": "linux",
     },
-    "category": "agent",
+    "category": category,
     "type": os.environ["SAC_EVENT_TYPE"],
     "severity": os.environ["SAC_SEVERITY"],
     "title": os.environ["SAC_TITLE"],
@@ -152,13 +165,30 @@ PY
  return 1
 }
 
-# notify_or_sac type severity title summary telegram_message
+# JSON details из переменных SAC_D_* (опционально)
+sac_build_details_json() {
+ python3 <<'PY'
+import json, os
+out = {}
+for k, v in os.environ.items():
+    if k.startswith("SAC_D_") and v:
+        out[k[6:].lower()] = v
+print(json.dumps(out) if out else "")
+PY
+}
+
+# notify_or_sac type severity title summary telegram_message [details_json]
 notify_or_sac() {
  local event_type="$1"
  local severity="$2"
  local title="$3"
  local summary="$4"
  local telegram_message="${5:-$summary}"
+ local details_json="${6:-}"
+ if [ -z "$details_json" ] && [ -n "${SAC_D_USER:-}${SAC_D_IP:-}${SAC_D_COMMAND:-}" ]; then
+  details_json="$(sac_build_details_json)"
+ fi
+ unset SAC_D_USER SAC_D_IP SAC_D_COMMAND SAC_D_ATTEMPT SAC_D_MAX SAC_D_RUN_AS SAC_D_PWD 2>/dev/null || true
  local mode
  mode="$(sac_normalize_mode "${UseSAC:-off}")"
 
@@ -167,14 +197,14 @@ notify_or_sac() {
  notify_send "$telegram_message"
  ;;
  exclusive)
- sac_send_event "$event_type" "$severity" "$title" "$summary"
+ sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json"
  ;;
  dual)
-  sac_send_event "$event_type" "$severity" "$title" "$summary" || true
+  sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json" || true
   NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"
   ;;
  fallback)
-  if sac_send_event "$event_type" "$severity" "$title" "$summary"; then
+  if sac_send_event "$event_type" "$severity" "$title" "$summary" "$details_json"; then
    return 0
   fi
   NOTIFY_SKIP_SAC_MIRROR=1 notify_send "$telegram_message"