feat(ansible): add incident screenshot controls for windows phase2

ansible/README.md

@@ -81,6 +81,9 @@ Playbook:
 
 - `aw_windows_afk_enabled: false` — не запускать `aw-watcher-afk`;
 - `aw_windows_window_enabled: false` — не запускать `aw-watcher-window`;
+- `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
+- `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
+- `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
 - `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
 
 ## Результат

ansible/deploy_aw_windows_phase2.yml

@@ -22,6 +22,9 @@
     aw_windows_afk_enabled: true
     aw_windows_window_enabled: true
     aw_windows_local_agent_logs_enabled: false
+    aw_windows_incident_capture_enabled: true
+    aw_windows_incident_screenshot_enabled: true
+    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
     aw_windows_logon_marker_enabled: true
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
@@ -90,6 +93,9 @@
             AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
             WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
             LocalAgentLogsEnabled = {{ '$true' if (aw_windows_local_agent_logs_enabled | bool) else '$false' }}
+            IncidentCaptureEnabled = {{ '$true' if (aw_windows_incident_capture_enabled | bool) else '$false' }}
+            IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
+            IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
             LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
             CustomRulesPath = "{{ aw_windows_rules_path }}"
             CustomPolicyPath = "{{ aw_windows_policy_path }}"

ansible/group_vars/windows.example.yml

@@ -20,6 +20,9 @@ aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_local_agent_logs_enabled: false
+aw_windows_incident_capture_enabled: true
+aw_windows_incident_screenshot_enabled: true
+aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
 aw_windows_logon_marker_enabled: true
 aw_windows_skip_hardening: false