From b420104f1f9f6bd3d48d9353e487a004b4ef4267 Mon Sep 17 00:00:00 2001
From: igor04091968 <igor04091968@gmail.com>
Date: Thu, 21 May 2026 22:41:15 +0300
Subject: [PATCH] feat(alerts): enable telegram and improve operator text

---
 ansible/group_vars/all.example.yml           |  2 +-
 ansible/group_vars/all.yml                   |  2 +-
 aw-server/aw-server.env.example              |  2 +-
 aw-server/hayabusa/aw-hayabusa-case-alert.py | 49 +++++++++++++++-----
 4 files changed, 41 insertions(+), 14 deletions(-)

diff --git a/ansible/group_vars/all.example.yml b/ansible/group_vars/all.example.yml
index 68a3baf..bf95147 100644
--- a/ansible/group_vars/all.example.yml
+++ b/ansible/group_vars/all.example.yml
@@ -33,7 +33,7 @@ aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
-aw_hayabusa_telegram_enabled: false
+aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""
diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
index 0f4a886..7aae288 100644
--- a/ansible/group_vars/all.yml
+++ b/ansible/group_vars/all.yml
@@ -31,7 +31,7 @@ aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
-aw_hayabusa_telegram_enabled: false
+aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""
diff --git a/aw-server/aw-server.env.example b/aw-server/aw-server.env.example
index f0469da..0c1594b 100755
--- a/aw-server/aw-server.env.example
+++ b/aw-server/aw-server.env.example
@@ -46,7 +46,7 @@ AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 # Hayabusa auto-case / alerting
 AW_HAYABUSA_AUTO_CASE_ENABLED=true
 AW_HAYABUSA_AUTO_CASE_MIN_SEVERITY=medium
-AW_HAYABUSA_TELEGRAM_ENABLED=false
+AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=
diff --git a/aw-server/hayabusa/aw-hayabusa-case-alert.py b/aw-server/hayabusa/aw-hayabusa-case-alert.py
index 4f12061..fe0fa01 100644
--- a/aw-server/hayabusa/aw-hayabusa-case-alert.py
+++ b/aw-server/hayabusa/aw-hayabusa-case-alert.py
@@ -243,18 +243,45 @@ def send_telegram(bot_token: str, chat_ids: list[str], text: str) -> list[dict[s
 
 
 def build_telegram_text(case_id: int | None, intake: dict[str, Any], summary: dict[str, Any]) -> str:
-    top = ", ".join(f"{item['title']} ({item['count']})" for item in summary.get("top_rules", [])[:3]) or "n/a"
-    case_part = f"\nCase: {case_id}" if case_id is not None else ""
-    return (
-        f"Hayabusa {summary['severity'].upper()} alert\n"
-        f"Host: {intake['host']}{case_part}\n"
-        f"Intake: {intake['intake_id']}\n"
-        f"Score: {summary['score']}\n"
-        f"Events: {summary['events_total']}, failed_logons={summary['failed_logon_rows']}, "
-        f"suspicious_pwsh={summary['suspicious_pwsh']}\n"
-        f"Top rules: {top}\n"
-        f"Report: {intake['report_dir']}"
+    severity_label = {
+        "critical": "критичное событие",
+        "high": "опасное событие",
+        "medium": "подозрительное событие",
+        "low": "слабый сигнал",
+    }.get(summary["severity"], summary["severity"])
+    top_rules = summary.get("top_rules", [])
+    top_rule = top_rules[0]["title"] if top_rules else "нет явного доминирующего правила"
+    lines = [
+        f"Hayabusa: {severity_label}",
+        "",
+        f"Хост: {intake['host']}",
+    ]
+    if case_id is not None:
+        lines.append(f"Кейс: {case_id}")
+    lines.extend(
+        [
+            f"Уровень: {summary['severity']}",
+            "",
+            "Что найдено:",
+            f"- {top_rule}: {top_rules[0]['count'] if top_rules else 0}",
+            f"- подозрительный PowerShell: {summary['suspicious_pwsh']}",
+            f"- ошибок входа: {summary['logon_failure_events']}",
+            f"- событий по учётным данным: {summary['credential_events']}",
+        ]
     )
+    if summary.get("timestomp_events", 0) > 0:
+        lines.append(f"- timestomp-подобных событий: {summary['timestomp_events']}")
+    lines.extend(
+        [
+            "",
+            "Главный риск:",
+            "возможная активность вокруг учётных данных и PowerShell",
+            "",
+            "Отчёт:",
+            f"{intake['report_dir']}",
+        ]
+    )
+    return "\n".join(lines)
 
 
 def main() -> int: