feat(alerts): enable telegram and improve operator text

ansible/group_vars/all.example.yml

@@ -33,7 +33,7 @@ aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
-aw_hayabusa_telegram_enabled: false
+aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""

ansible/group_vars/all.yml

@@ -31,7 +31,7 @@ aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
-aw_hayabusa_telegram_enabled: false
+aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""

aw-server/aw-server.env.example

@@ -46,7 +46,7 @@ AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 # Hayabusa auto-case / alerting
 AW_HAYABUSA_AUTO_CASE_ENABLED=true
 AW_HAYABUSA_AUTO_CASE_MIN_SEVERITY=medium
-AW_HAYABUSA_TELEGRAM_ENABLED=false
+AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=

aw-server/hayabusa/aw-hayabusa-case-alert.py

@@ -243,18 +243,45 @@ def send_telegram(bot_token: str, chat_ids: list[str], text: str) -> list[dict[s
 
 
 def build_telegram_text(case_id: int | None, intake: dict[str, Any], summary: dict[str, Any]) -> str:
-    top = ", ".join(f"{item['title']} ({item['count']})" for item in summary.get("top_rules", [])[:3]) or "n/a"
+    severity_label = {
-    case_part = f"\nCase: {case_id}" if case_id is not None else ""
+        "critical": "критичное событие",
-    return (
+        "high": "опасное событие",
-        f"Hayabusa {summary['severity'].upper()} alert\n"
+        "medium": "подозрительное событие",
-        f"Host: {intake['host']}{case_part}\n"
+        "low": "слабый сигнал",
-        f"Intake: {intake['intake_id']}\n"
+    }.get(summary["severity"], summary["severity"])
-        f"Score: {summary['score']}\n"
+    top_rules = summary.get("top_rules", [])
-        f"Events: {summary['events_total']}, failed_logons={summary['failed_logon_rows']}, "
+    top_rule = top_rules[0]["title"] if top_rules else "нет явного доминирующего правила"
-        f"suspicious_pwsh={summary['suspicious_pwsh']}\n"
+    lines = [
-        f"Top rules: {top}\n"
+        f"Hayabusa: {severity_label}",
-        f"Report: {intake['report_dir']}"
+        "",
+        f"Хост: {intake['host']}",
+    ]
+    if case_id is not None:
+        lines.append(f"Кейс: {case_id}")
+    lines.extend(
+        [
+            f"Уровень: {summary['severity']}",
+            "",
+            "Что найдено:",
+            f"- {top_rule}: {top_rules[0]['count'] if top_rules else 0}",
+            f"- подозрительный PowerShell: {summary['suspicious_pwsh']}",
+            f"- ошибок входа: {summary['logon_failure_events']}",
+            f"- событий по учётным данным: {summary['credential_events']}",
+        ]
     )
+    if summary.get("timestomp_events", 0) > 0:
+        lines.append(f"- timestomp-подобных событий: {summary['timestomp_events']}")
+    lines.extend(
+        [
+            "",
+            "Главный риск:",
+            "возможная активность вокруг учётных данных и PowerShell",
+            "",
+            "Отчёт:",
+            f"{intake['report_dir']}",
+        ]
+    )
+    return "\n".join(lines)
 
 
 def main() -> int: