8b1ba3c310
Server-side RMM telemetry plugin: current-snapshot endpointstates plus append-only curated endpointevents, resolved to existing Computer assets by hostname. Adds ADR-010 asset panels (status, services, recent events), dashboard quiet and stability cards, and a minimal Fleet list view that links into existing PC detail pages. Registers the activity sidebar icon and a dev-only sample seeder. Ingest arrives on the generic collector route; the future C# agent design record lives in docs/DESIGN-DECISIONS-agent.md.
47 lines
2.0 KiB
Python
47 lines
2.0 KiB
Python
"""Curated Windows event catalog: id -> human title and severity.
|
|
|
|
Single server-side source of truth shared by the recent-events asset panel and
|
|
the stability dashboard card, so a 4625 reads as "Failed logon (warning)" in
|
|
both places without either restating the mapping. The set of IDs here MUST stay
|
|
in step with CURATED_EVENT_IDS in plugin.py; a test asserts they match.
|
|
|
|
Severity vocabulary matches the dashboard card renderer: 'critical', 'warning',
|
|
'info'. The IDs marked critical are the ones an operator/tech should act on
|
|
without being asked - unexpected shutdown, crash, filesystem corruption, SCM
|
|
timeout. Logon activity is informational history unless it is a failure.
|
|
"""
|
|
|
|
# id -> (title, severity, channel)
|
|
EVENT_CATALOG = {
|
|
4624: ('Successful logon', 'info', 'Security'),
|
|
4625: ('Failed logon', 'warning', 'Security'),
|
|
4634: ('Logoff', 'info', 'Security'),
|
|
4672: ('Special privileges assigned', 'info', 'Security'),
|
|
4697: ('Service installed', 'warning', 'Security'),
|
|
4698: ('Scheduled task created', 'warning', 'Security'),
|
|
41: ('Unexpected shutdown', 'critical', 'System'),
|
|
4618: ('Monitored security event', 'warning', 'Security'),
|
|
55: ('File system corruption', 'critical', 'System'),
|
|
7011: ('Service timeout', 'critical', 'System'),
|
|
10016: ('DCOM permission error', 'warning', 'System'),
|
|
1001: ('Application crash', 'critical', 'Application'),
|
|
}
|
|
|
|
# The IDs a tech should see surfaced fleet-wide on the dashboard stability card.
|
|
CRITICAL_EVENT_IDS = tuple(
|
|
eventid for eventid, (_t, severity, _c) in EVENT_CATALOG.items()
|
|
if severity == 'critical'
|
|
)
|
|
|
|
|
|
def event_title(eventid):
|
|
"""Human title for a curated event id, or a generic fallback."""
|
|
entry = EVENT_CATALOG.get(eventid)
|
|
return entry[0] if entry else 'Event {}'.format(eventid)
|
|
|
|
|
|
def event_severity(eventid):
|
|
"""Severity ('critical'|'warning'|'info') for a curated event id."""
|
|
entry = EVENT_CATALOG.get(eventid)
|
|
return entry[1] if entry else 'info'
|