fix(hayabusa): restore scheduled EVTX upload pipeline

2026-06-12 10:57:39 +03:00
parent 7919051688
commit 106d796d95
18 changed files with 164 additions and 19 deletions
@@ -942,6 +942,7 @@ function New-ActivityWatchDeploymentConfig {
        [int]$HayabusaAutoUploadHoursBack = 6,
        [string]$HayabusaAutoUploadMode = 'incident',
        [string]$HayabusaAutoUploadTaskName = 'ActivityWatch Hayabusa Upload',
+        [string]$HayabusaAutoUploadRunAsUser,
        [bool]$File1CAutoUploadEnabled = $true,
        [int]$File1CAutoUploadIntervalHours = 6,
        [int]$File1CAutoUploadIntervalMinutes = 15,
@@ -1037,6 +1038,7 @@ function New-ActivityWatchDeploymentConfig {
                hoursBack = $HayabusaAutoUploadHoursBack
                mode = $HayabusaAutoUploadMode
                taskName = $HayabusaAutoUploadTaskName
+                runAsUser = $HayabusaAutoUploadRunAsUser
            }
        }
        analytics = [pscustomobject]@{
@@ -2531,11 +2533,16 @@ function Register-ActivityWatchHayabusaAutoUploadTask {
    $intervalHours = [Math]::Max(1, [int]$automation.intervalHours)
    $hoursBack = [Math]::Max(1, [int]$automation.hoursBack)
    $mode = if ($automation.PSObject.Properties.Name -contains 'mode' -and -not [string]::IsNullOrWhiteSpace([string]$automation.mode)) { [string]$automation.mode } else { 'incident' }
+    $runAsUser = if ($automation.PSObject.Properties.Name -contains 'runAsUser' -and -not [string]::IsNullOrWhiteSpace([string]$automation.runAsUser)) { [string]$automation.runAsUser } else { '' }
    $powerShellExe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
    $taskCommand = "`"$powerShellExe`" -NoProfile -ExecutionPolicy Bypass -File `"$uploadScript`" -ConfigPath `"$ConfigPath`" -HoursBack $hoursBack -Mode `"$mode`""

    Remove-ActivityWatchScheduledTask -TaskName $taskName
-    & schtasks.exe /Create /TN $taskName /TR $taskCommand /SC HOURLY /MO $intervalHours /ST 00:00 /RU SYSTEM /RL HIGHEST /F | Out-Null
+    if ($runAsUser) {
+        & schtasks.exe /Create /TN $taskName /TR $taskCommand /SC HOURLY /MO $intervalHours /ST 00:00 /RU $runAsUser /IT /RL HIGHEST /F | Out-Null
+    } else {
+        & schtasks.exe /Create /TN $taskName /TR $taskCommand /SC HOURLY /MO $intervalHours /ST 00:00 /RU SYSTEM /RL HIGHEST /F | Out-Null
+    }
    if ($LASTEXITCODE -ne 0) {
        throw "Не удалось создать scheduled task $taskName через schtasks.exe"
    }
@@ -45,6 +45,7 @@ param(
    [int]$HayabusaAutoUploadHoursBack = 6,
    [string]$HayabusaAutoUploadMode = 'incident',
    [string]$HayabusaAutoUploadTaskName = 'ActivityWatch Hayabusa Upload',
+    [string]$HayabusaAutoUploadRunAsUser,
    [bool]$File1CAutoUploadEnabled = $true,
    [int]$File1CAutoUploadIntervalHours = 6,
    [int]$File1CAutoUploadIntervalMinutes = 15,
@@ -157,6 +158,7 @@ $config = New-ActivityWatchDeploymentConfig `
    -HayabusaAutoUploadHoursBack $HayabusaAutoUploadHoursBack `
    -HayabusaAutoUploadMode $HayabusaAutoUploadMode `
    -HayabusaAutoUploadTaskName $HayabusaAutoUploadTaskName `
+    -HayabusaAutoUploadRunAsUser $HayabusaAutoUploadRunAsUser `
    -File1CAutoUploadEnabled $File1CAutoUploadEnabled `
    -File1CAutoUploadIntervalHours $File1CAutoUploadIntervalHours `
    -File1CAutoUploadIntervalMinutes $File1CAutoUploadIntervalMinutes `
@@ -46,6 +46,7 @@ param(
    [int]$HayabusaAutoUploadHoursBack = 6,
    [string]$HayabusaAutoUploadMode = 'incident',
    [string]$HayabusaAutoUploadTaskName = 'ActivityWatch Hayabusa Upload',
+    [string]$HayabusaAutoUploadRunAsUser,
    [bool]$File1CAutoUploadEnabled = $true,
    [int]$File1CAutoUploadIntervalHours = 6,
    [int]$File1CAutoUploadIntervalMinutes = 15,
@@ -118,6 +119,7 @@ if (-not (Test-Path -LiteralPath $deployScript)) {
    -HayabusaAutoUploadHoursBack $HayabusaAutoUploadHoursBack `
    -HayabusaAutoUploadMode $HayabusaAutoUploadMode `
    -HayabusaAutoUploadTaskName $HayabusaAutoUploadTaskName `
+    -HayabusaAutoUploadRunAsUser $HayabusaAutoUploadRunAsUser `
    -File1CAutoUploadEnabled $File1CAutoUploadEnabled `
    -File1CAutoUploadIntervalHours $File1CAutoUploadIntervalHours `
    -File1CAutoUploadIntervalMinutes $File1CAutoUploadIntervalMinutes `
@@ -16,6 +16,25 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'

+$LogDir = Join-Path (Split-Path -Parent $ConfigPath) 'logs'
+$LogPath = Join-Path $LogDir 'hayabusa-upload.log'
+New-Item -ItemType Directory -Path $LogDir -Force | Out-Null
+
+function Write-RunLog {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Message
+    )
+
+    $line = '{0} {1}' -f ([DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')), $Message
+    Add-Content -LiteralPath $LogPath -Value $line -Encoding UTF8
+}
+
+trap {
+    Write-RunLog ("ERROR: " + ($_ | Out-String).Trim())
+    exit 1
+}
+
 function New-TemporarySshKeyCopy {
    param(
        [Parameter(Mandatory = $true)]
@@ -27,9 +46,20 @@ function New-TemporarySshKeyCopy {
    $tempKeyPath = Join-Path $tempDir 'awops_ed25519'
    Copy-Item -LiteralPath $SourceKeyPath -Destination $tempKeyPath -Force

+    $currentIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+    $grantPrincipals = @(
+        ('*' + $currentIdentity.User.Value),
+        '*S-1-5-18',
+        '*S-1-5-32-544'
+    ) |
+        Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } |
+        Select-Object -Unique
+
    & icacls.exe $tempKeyPath /inheritance:r | Out-Null
-    & icacls.exe $tempKeyPath /grant:r "$($env:USERNAME):(F)" | Out-Null
-    & icacls.exe $tempKeyPath /remove:g 'Users' 'Authenticated Users' 'Everyone' 'BUILTIN\Users' 'BUILTIN\Administrators' 'NT AUTHORITY\SYSTEM' 2>$null | Out-Null
+    foreach ($principal in $grantPrincipals) {
+        & icacls.exe $tempKeyPath /grant:r "$principal`:(F)" | Out-Null
+    }
+    & icacls.exe $tempKeyPath /remove:g 'Users' 'Authenticated Users' 'Everyone' 'BUILTIN\Users' 2>$null | Out-Null

    return $tempKeyPath
 }
@@ -42,6 +72,8 @@ if (-not (Test-Path -LiteralPath $RemoteKeyPath)) {
    throw "SSH private key not found: $RemoteKeyPath"
 }

+Write-RunLog ("start hoursBack={0} daysBack={1} mode={2} serverHost={3} runRemote={4}" -f $HoursBack, $DaysBack, $Mode, $ServerHost, [bool]$RunRemote)
+
 $config = Get-Content -Raw -LiteralPath $ConfigPath | ConvertFrom-Json
 if ([string]::IsNullOrWhiteSpace($ServerHost)) {
    $ServerHost = [string]$config.server.host
@@ -81,7 +113,8 @@ try {
    if ($null -ne $CaseId) {
        $meta.case_id = [int]$CaseId
    }
-    $meta | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $metaPath -Encoding UTF8
+    $metaJson = $meta | ConvertTo-Json -Depth 6
+    [System.IO.File]::WriteAllText($metaPath, $metaJson, [System.Text.UTF8Encoding]::new($false))
    & scp.exe -i $effectiveKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $metaPath $remoteTarget
    if ($LASTEXITCODE -ne 0) {
        throw "scp meta upload failed with rc=$LASTEXITCODE"
@@ -97,6 +130,7 @@ try {
    if ($LASTEXITCODE -ne 0) {
        throw "scp upload failed with rc=$LASTEXITCODE"
    }
+    Write-RunLog ("upload complete zip={0} remote={1}" -f $zipPath, $remoteTarget)
 }
 finally {
    Remove-Item -LiteralPath $effectiveKeyPath -Force -ErrorAction SilentlyContinue
@@ -119,6 +119,7 @@ $effectiveHayabusaAutoUploadIntervalHours = if ($existingConfig -and $existingCo
 $effectiveHayabusaAutoUploadHoursBack = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'forensics' -and $existingConfig.forensics.PSObject.Properties.Name -contains 'hayabusaAutomation' -and $existingConfig.forensics.hayabusaAutomation.PSObject.Properties.Name -contains 'hoursBack') { [int]$existingConfig.forensics.hayabusaAutomation.hoursBack } else { 6 }
 $effectiveHayabusaAutoUploadMode = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'forensics' -and $existingConfig.forensics.PSObject.Properties.Name -contains 'hayabusaAutomation' -and $existingConfig.forensics.hayabusaAutomation.PSObject.Properties.Name -contains 'mode') { [string]$existingConfig.forensics.hayabusaAutomation.mode } else { 'incident' }
 $effectiveHayabusaAutoUploadTaskName = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'forensics' -and $existingConfig.forensics.PSObject.Properties.Name -contains 'hayabusaAutomation' -and $existingConfig.forensics.hayabusaAutomation.PSObject.Properties.Name -contains 'taskName') { [string]$existingConfig.forensics.hayabusaAutomation.taskName } else { 'ActivityWatch Hayabusa Upload' }
+$effectiveHayabusaAutoUploadRunAsUser = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'forensics' -and $existingConfig.forensics.PSObject.Properties.Name -contains 'hayabusaAutomation' -and $existingConfig.forensics.hayabusaAutomation.PSObject.Properties.Name -contains 'runAsUser') { [string]$existingConfig.forensics.hayabusaAutomation.runAsUser } else { '' }
 $effectiveFile1CAutoUploadEnabled = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'analytics' -and $existingConfig.analytics.PSObject.Properties.Name -contains 'file1cAutomation' -and $existingConfig.analytics.file1cAutomation.PSObject.Properties.Name -contains 'enabled') { [bool]$existingConfig.analytics.file1cAutomation.enabled } else { $true }
 $effectiveFile1CAutoUploadIntervalHours = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'analytics' -and $existingConfig.analytics.PSObject.Properties.Name -contains 'file1cAutomation' -and $existingConfig.analytics.file1cAutomation.PSObject.Properties.Name -contains 'intervalHours') { [int]$existingConfig.analytics.file1cAutomation.intervalHours } else { 6 }
 $effectiveFile1CAutoUploadIntervalMinutes = if ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'analytics' -and $existingConfig.analytics.PSObject.Properties.Name -contains 'file1cAutomation' -and $existingConfig.analytics.file1cAutomation.PSObject.Properties.Name -contains 'intervalMinutes') { [int]$existingConfig.analytics.file1cAutomation.intervalMinutes } else { [Math]::Max(1, $effectiveFile1CAutoUploadIntervalHours) * 60 }
@@ -237,6 +238,7 @@ $config = New-ActivityWatchDeploymentConfig `
    -HayabusaAutoUploadHoursBack $effectiveHayabusaAutoUploadHoursBack `
    -HayabusaAutoUploadMode $effectiveHayabusaAutoUploadMode `
    -HayabusaAutoUploadTaskName $effectiveHayabusaAutoUploadTaskName `
+    -HayabusaAutoUploadRunAsUser $effectiveHayabusaAutoUploadRunAsUser `
    -File1CAutoUploadEnabled $effectiveFile1CAutoUploadEnabled `
    -File1CAutoUploadIntervalHours $effectiveFile1CAutoUploadIntervalHours `
    -File1CAutoUploadIntervalMinutes $effectiveFile1CAutoUploadIntervalMinutes `