Русифицировать DLP PowerShell и исправить имя документа печати

windows/dlp-endpoint-signals-collector.ps1

@@ -210,7 +210,7 @@ function Capture-IncidentScreenshot {
         }
     }
     catch {
-        Write-EndpointLog ("screenshot capture failed: {0}" -f $_.Exception.Message)
+        Write-EndpointLog ("не удалось сделать снимок инцидента: {0}" -f $_.Exception.Message)
         return @{}
     }
 }
@@ -246,7 +246,7 @@ function Load-DlpPolicy {
     }
 
     if (-not $Path -or -not (Test-Path -LiteralPath $Path)) {
-        Write-EndpointLog ("policy not found, using defaults: {0}" -f $Path)
+        Write-EndpointLog ("DLP-политика не найдена, используются значения по умолчанию: {0}" -f $Path)
         return
     }
 
@@ -266,7 +266,7 @@ function Load-DlpPolicy {
         }
     }
     catch {
-        Write-EndpointLog ("policy parse failed: {0}" -f $_.Exception.Message)
+        Write-EndpointLog ("не удалось разобрать DLP-политику: {0}" -f $_.Exception.Message)
     }
 }
 
@@ -319,13 +319,13 @@ function Evaluate-ClipboardRules {
 
         $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
         $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
-        $message = if ($rule.message) { [string]$rule.message } else { "Clipboard rule matched: $ruleId" }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило буфера обмена: $ruleId" }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'clipboard' -Data @{
             clipboardHash = $ClipboardHash
             clipboardLength = $ClipboardText.Length
         }
-        Write-EndpointLog ("incident clipboard rule={0} action={1} severity={2}" -f $ruleId, $action, $severity)
+        Write-EndpointLog ("инцидент буфера обмена правило={0} действие={1} важность={2}" -f $ruleId, $action, $severity)
     }
 }
 
@@ -347,13 +347,13 @@ function Evaluate-UsbRules {
 
         $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
         $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
-        $message = if ($rule.message) { [string]$rule.message } else { "USB rule matched: $ruleId" }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило USB-носителя: $ruleId" }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'usb_insert' -Data @{
             driveLetter = $DriveLetter
             volumeName  = $VolumeName
         }
-        Write-EndpointLog ("incident usb rule={0} action={1} severity={2} drive={3}" -f $ruleId, $action, $severity, $DriveLetter)
+        Write-EndpointLog ("инцидент USB правило={0} действие={1} важность={2} диск={3}" -f $ruleId, $action, $severity, $DriveLetter)
     }
 }
 
@@ -385,14 +385,14 @@ function Evaluate-PrintRules {
 
         $action = if ($rule.action) { [string]$rule.action } else { [string]$script:Policy.defaults.action }
         $severity = if ($rule.severity) { [string]$rule.severity } else { [string]$script:Policy.defaults.severity }
-        $message = if ($rule.message) { [string]$rule.message } else { "Print rule matched: $ruleId" }
+        $message = if ($rule.message) { [string]$rule.message } else { "Сработало правило печати: $ruleId" }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'print_job' -Data @{
             printerName  = $PrinterName
             documentName = $DocumentName
             owner        = $Owner
         }
-        Write-EndpointLog ("incident print rule={0} action={1} severity={2} printer={3}" -f $ruleId, $action, $severity, $PrinterName)
+        Write-EndpointLog ("инцидент печати правило={0} действие={1} важность={2} принтер={3}" -f $ruleId, $action, $severity, $PrinterName)
     }
 }
 
@@ -402,6 +402,52 @@ function Test-LooksLikeMojibakeQuestionMarks {
     return $Value -match '\?{2,}'
 }
 
+function Test-DocumentNameNeedsFallback {
+    param([AllowNull()][string]$Value)
+
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    $trimmed = $Value.Trim()
+    if (Test-LooksLikeMojibakeQuestionMarks -Value $trimmed) { return $true }
+    if ($trimmed -match '^[0-9]+$') { return $true }
+    if ($trimmed -match '^(?i)(print document|document|local downlevel document)$') { return $true }
+    return $false
+}
+
+function Get-EventXmlValue {
+    param(
+        [Parameter(Mandatory = $true)][xml]$EventXml,
+        [Parameter(Mandatory = $true)][string]$Name
+    )
+
+    $node = $EventXml.Event.UserData.DocumentPrinted.$Name
+    if ($null -ne $node) {
+        return [string]$node
+    }
+
+    return ''
+}
+
+function Get-PrintJobPrinterName {
+    param(
+        [AllowNull()][string]$JobName,
+        [AllowNull()][string]$FallbackPrinterName
+    )
+
+    if ([string]::IsNullOrWhiteSpace($JobName)) {
+        if (-not [string]::IsNullOrWhiteSpace($FallbackPrinterName)) {
+            return $FallbackPrinterName.Trim()
+        }
+        return ''
+    }
+
+    $parts = $JobName -split ',', 2
+    if ($parts.Count -gt 0 -and -not [string]::IsNullOrWhiteSpace($parts[0])) {
+        return $parts[0].Trim()
+    }
+
+    return $JobName.Trim()
+}
+
 function Normalize-OwnerForMatch {
     param([AllowNull()][string]$Value)
     if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -469,13 +515,50 @@ function Get-PrintServiceEventSummary {
         $propertyValues += [string]$prop.Value
     }
 
+    $xml = $null
+    try {
+        $xml = [xml]$Event.ToXml()
+    }
+    catch {
+    }
+
+    $jobId = ''
+    $documentName = ''
+    $owner = ''
+    $portName = ''
+    $printerName = ''
+    $sizeBytes = ''
+    $pageCount = ''
+
+    if ($xml) {
+        $jobId = Get-EventXmlValue -EventXml $xml -Name 'Param1'
+        $documentName = Get-EventXmlValue -EventXml $xml -Name 'Param2'
+        $owner = Get-EventXmlValue -EventXml $xml -Name 'Param3'
+        $portName = Get-EventXmlValue -EventXml $xml -Name 'Param4'
+        $printerName = Get-EventXmlValue -EventXml $xml -Name 'Param5'
+        $sizeBytes = Get-EventXmlValue -EventXml $xml -Name 'Param7'
+        $pageCount = Get-EventXmlValue -EventXml $xml -Name 'Param8'
+    }
+
+    if ([string]::IsNullOrWhiteSpace($jobId) -and $props.Count -ge 1) { $jobId = [string]$props[0].Value }
+    if ([string]::IsNullOrWhiteSpace($documentName) -and $props.Count -ge 2) { $documentName = [string]$props[1].Value }
+    if ([string]::IsNullOrWhiteSpace($owner) -and $props.Count -ge 3) { $owner = [string]$props[2].Value }
+    if ([string]::IsNullOrWhiteSpace($portName) -and $props.Count -ge 4) { $portName = [string]$props[3].Value }
+    if ([string]::IsNullOrWhiteSpace($printerName) -and $props.Count -ge 5) { $printerName = [string]$props[4].Value }
+    if ([string]::IsNullOrWhiteSpace($sizeBytes) -and $props.Count -ge 7) { $sizeBytes = [string]$props[6].Value }
+    if ([string]::IsNullOrWhiteSpace($pageCount) -and $props.Count -ge 8) { $pageCount = [string]$props[7].Value }
+
     [pscustomobject]@{
         RecordId      = [string]$Event.RecordId
         TimeCreated   = if ($Event.TimeCreated) { $Event.TimeCreated.ToString('o') } else { '' }
         PropertyCount  = $props.Count
-        DocumentName   = if ($props.Count -ge 1) { [string]$props[0].Value } else { '' }
-        Owner         = if ($props.Count -ge 2) { [string]$props[1].Value } else { '' }
-        PrinterName   = if ($props.Count -ge 4) { [string]$props[3].Value } else { '' }
+        JobId          = $jobId
+        DocumentName   = $documentName
+        Owner          = $owner
+        PortName       = $portName
+        PrinterName    = $printerName
+        SizeBytes      = $sizeBytes
+        PageCount      = $pageCount
         PropertyValues = $propertyValues
     }
 }
@@ -488,7 +571,7 @@ function Get-PrintServiceDocumentFallback {
     )
 
     $preferred = [string]$EventSummary.DocumentName
-    if (-not (Test-LooksLikeMojibakeQuestionMarks -Value $preferred) -and $preferred -notmatch '^[0-9]+$') {
+    if (-not (Test-DocumentNameNeedsFallback -Value $preferred)) {
         return $preferred
     }
 
@@ -499,9 +582,10 @@ function Get-PrintServiceDocumentFallback {
         $candidate = [string]$value
         if ([string]::IsNullOrWhiteSpace($candidate)) { continue }
         if ($candidate -eq $preferred) { continue }
+        if ($EventSummary.JobId -and $candidate -eq [string]$EventSummary.JobId) { continue }
         if ($Owner -and $candidate -like "*$Owner*") { continue }
         if ($PrinterName -and $candidate -like "*$PrinterName*") { continue }
-        if (Test-LooksLikeMojibakeQuestionMarks -Value $candidate) { continue }
+        if (Test-DocumentNameNeedsFallback -Value $candidate) { continue }
 
         if ($candidate -match '[\\/:]' -and $candidate -match '\.[A-Za-z0-9]{1,8}$') {
             $pathCandidates.Add($candidate)
@@ -546,7 +630,7 @@ function Write-PrintServiceEventTrace {
     }
 
     Write-EndpointLog (
-        'printservice-307 phase={0} recordId={1} time={2} owner={3} printer={4} document={5} resolved={6} properties=[{7}] reason={8}' -f
+        'printservice-307 этап={0} recordId={1} время={2} владелец={3} принтер={4} документ={5} итоговыйДокумент={6} свойства=[{7}] причина={8}' -f
         $Phase,
         $EventSummary.RecordId,
         $EventSummary.TimeCreated,
@@ -561,6 +645,7 @@ function Write-PrintServiceEventTrace {
 
 function Get-BetterDocumentNameFromPrintServiceEvents {
     param(
+        [string]$JobId,
         [string]$Owner,
         [string]$PrinterName
     )
@@ -578,32 +663,41 @@ function Get-BetterDocumentNameFromPrintServiceEvents {
                 $summary = Get-PrintServiceEventSummary -Event $event
                 $resolvedDocument = Get-PrintServiceDocumentFallback -EventSummary $summary -Owner $Owner -PrinterName $PrinterName
 
+                $jobMatches = if ($JobId) { [string]$summary.JobId -eq [string]$JobId } else { $true }
                 $ownerMatches = if ($Owner) { Test-OwnerLooseMatch -Expected $Owner -Actual $summary.Owner } else { $true }
                 $printerMatches = if ($PrinterName) { Test-PrinterLooseMatch -Expected $PrinterName -Actual $summary.PrinterName } else { $true }
 
                 if ($pass -eq 'strict') {
+                    if ($JobId -and -not $jobMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-jobid-strict' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
                     if ($Owner -and -not $ownerMatches) {
-                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'owner-mismatch-strict' -ResolvedDocument $resolvedDocument
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-strict' -ResolvedDocument $resolvedDocument
                         continue
                     }
                     if ($PrinterName -and -not $printerMatches) {
-                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'printer-mismatch-strict' -ResolvedDocument $resolvedDocument
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-принтера-strict' -ResolvedDocument $resolvedDocument
                         continue
                     }
                 }
                 else {
-                    if ($Owner -and $PrinterName -and -not $ownerMatches -and -not $printerMatches) {
-                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'owner-and-printer-mismatch-relaxed' -ResolvedDocument $resolvedDocument
+                    if ($JobId -and (-not $jobMatches) -and $Owner -and $PrinterName -and -not $ownerMatches -and -not $printerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-и-принтера-relaxed' -ResolvedDocument $resolvedDocument
+                        continue
+                    }
+                    if ((-not $JobId) -and $Owner -and $PrinterName -and -not $ownerMatches -and -not $printerMatches) {
+                        Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason 'несовпадение-владельца-и-принтера-relaxed' -ResolvedDocument $resolvedDocument
                         continue
                     }
                 }
 
                 if ([string]::IsNullOrWhiteSpace($resolvedDocument)) {
-                    Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason ('no-document-candidate-' + $pass) -ResolvedDocument ''
+                    Write-PrintServiceEventTrace -EventSummary $summary -Phase 'scan' -MatchReason ('нет-кандидата-документа-' + $pass) -ResolvedDocument ''
                     continue
                 }
 
-                $matchReasonBase = if (Test-LooksLikeMojibakeQuestionMarks -Value $summary.DocumentName) { 'fallback-used' } else { 'direct' }
+                $matchReasonBase = if (Test-DocumentNameNeedsFallback -Value $summary.DocumentName) { 'использован-резервный-вариант' } else { 'напрямую' }
                 Write-PrintServiceEventTrace -EventSummary $summary -Phase 'selected' -MatchReason ($matchReasonBase + '-' + $pass) -ResolvedDocument $resolvedDocument
                 return $resolvedDocument
             }
@@ -616,7 +710,7 @@ function Get-BetterDocumentNameFromPrintServiceEvents {
 }
 
 $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
-$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'ServerHost is required.' }
+$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
 $resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
@@ -648,7 +742,7 @@ $script:IncidentScreenshotEnabled = $resolvedIncidentScreenshotEnabled
 $script:ScreenshotTypesLoaded = $false
 
 Load-DlpPolicy -Path $resolvedPolicyPath
-Write-EndpointLog ("endpoint collector started against {0}" -f $script:ApiBase)
+Write-EndpointLog ("endpoint-коллектор запущен для {0}" -f $script:ApiBase)
 
 while ($true) {
     try {
@@ -709,13 +803,13 @@ while ($true) {
                 if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
                 $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
 
-                $printerName = [string]$job.Name
+                $printerName = Get-PrintJobPrinterName -JobName ([string]$job.Name) -FallbackPrinterName ([string]$job.DriverName)
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
 
-                if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
-                    $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
+                if (Test-DocumentNameNeedsFallback -Value $documentName) {
+                    $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -JobId $jobId -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName
                     }
@@ -726,6 +820,7 @@ while ($true) {
                     documentName = $documentName
                     documentNameOriginal = $documentNameOriginal
                     owner        = $owner
+                    printJobId   = $jobId
                 }
                 Evaluate-PrintRules -PrinterName $printerName -DocumentName $documentName -Owner $owner
             }
@@ -789,7 +884,7 @@ while ($true) {
         }
     }
     catch {
-        Write-EndpointLog ("collector error: {0}" -f $_.Exception.Message)
+        Write-EndpointLog ("ошибка коллектора: {0}" -f $_.Exception.Message)
     }
 
     Start-Sleep -Seconds $resolvedPollSeconds