chore: merge main into PR #17
This commit is contained in:
igor04091968
@@ -1,4 +1,4 @@
|
||||
[CmdletBinding()]
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
|
||||
[string]$ServerHost,
|
||||
@@ -121,6 +121,14 @@ function Ensure-Bucket {
|
||||
return
|
||||
}
|
||||
|
||||
try {
|
||||
Invoke-RestMethod -Method Get -Uri "$($script:ApiBase)/buckets/$BucketId" | Out-Null
|
||||
$script:KnownBuckets[$BucketId] = $true
|
||||
return
|
||||
}
|
||||
catch {
|
||||
}
|
||||
|
||||
$body = @{
|
||||
client = $ClientName
|
||||
type = $BucketType
|
||||
@@ -295,6 +303,10 @@ function Show-EnforcementNotification {
|
||||
[Parameter(Mandatory = $true)][string]$Title,
|
||||
[Parameter(Mandatory = $true)][string]$Body
|
||||
)
|
||||
if ($script:HeadlessMode) {
|
||||
Write-EndpointLog ("headless mode: skip notification title={0}" -f $Title)
|
||||
return $false
|
||||
}
|
||||
try {
|
||||
Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue
|
||||
$icon = New-Object System.Windows.Forms.NotifyIcon
|
||||
@@ -306,9 +318,11 @@ function Show-EnforcementNotification {
|
||||
$icon.ShowBalloonTip(5000)
|
||||
Start-Sleep -Milliseconds 200
|
||||
$icon.Dispose()
|
||||
return $true
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("notification failed: {0}" -f $_.Exception.Message)
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
@@ -392,6 +406,44 @@ function Get-StringHash {
|
||||
}
|
||||
}
|
||||
|
||||
function Get-ClipboardTextSafe {
|
||||
[OutputType([string])]
|
||||
param()
|
||||
|
||||
try {
|
||||
$v = Get-Clipboard -Raw -ErrorAction Stop
|
||||
if ($null -ne $v) { return [string]$v }
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("clipboard direct read failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
|
||||
# Fallback: read clipboard in a dedicated STA thread for RDP/user-session edge cases.
|
||||
try {
|
||||
Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue | Out-Null
|
||||
$result = [string]::Empty
|
||||
$thread = [System.Threading.Thread]{
|
||||
try {
|
||||
$script:__aw_clip = [System.Windows.Forms.Clipboard]::GetText()
|
||||
}
|
||||
catch {
|
||||
$script:__aw_clip = $null
|
||||
}
|
||||
}
|
||||
$thread.SetApartmentState([System.Threading.ApartmentState]::STA)
|
||||
$thread.Start()
|
||||
$thread.Join(3000) | Out-Null
|
||||
if ($thread.IsAlive) { $thread.Abort() }
|
||||
$result = [string]$script:__aw_clip
|
||||
Remove-Variable -Name __aw_clip -Scope Script -ErrorAction SilentlyContinue
|
||||
return $result
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("clipboard STA read failed: {0}" -f $_.Exception.Message)
|
||||
return $null
|
||||
}
|
||||
}
|
||||
|
||||
function Load-DlpPolicy {
|
||||
param([string]$Path)
|
||||
|
||||
@@ -457,6 +509,9 @@ function Evaluate-ClipboardRules {
|
||||
[string]$ClipboardText,
|
||||
[string]$ClipboardHash
|
||||
)
|
||||
if ([string]::IsNullOrEmpty($ClipboardText) -or [string]::IsNullOrEmpty($ClipboardHash)) {
|
||||
return
|
||||
}
|
||||
|
||||
foreach ($rule in @($script:Policy.endpoint.clipboard)) {
|
||||
if (-not $rule) { continue }
|
||||
@@ -487,8 +542,13 @@ function Evaluate-ClipboardRules {
|
||||
|
||||
$enforced = $false
|
||||
if ($action -eq 'block') {
|
||||
$enforced = Invoke-ClipboardEnforcement
|
||||
Show-EnforcementNotification -Title 'DLP: буфер обмена очищен' -Body $message
|
||||
if ($script:HeadlessMode) {
|
||||
Write-EndpointLog ("headless fallback: clipboard rule={0} requires block, skipped interactive enforcement" -f $ruleId)
|
||||
}
|
||||
else {
|
||||
$enforced = Invoke-ClipboardEnforcement
|
||||
[void](Show-EnforcementNotification -Title 'DLP: буфер обмена очищен' -Body $message)
|
||||
}
|
||||
}
|
||||
|
||||
Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'clipboard' -Data @{
|
||||
@@ -522,8 +582,13 @@ function Evaluate-UsbRules {
|
||||
|
||||
$enforced = $false
|
||||
if ($action -eq 'block') {
|
||||
$enforced = Invoke-UsbWriteBlockEnforcement -DriveLetter $DriveLetter
|
||||
Show-EnforcementNotification -Title 'DLP: USB заблокирован для записи' -Body $message
|
||||
if ($script:HeadlessMode) {
|
||||
Write-EndpointLog ("headless fallback: usb rule={0} requires block, skipped interactive enforcement drive={1}" -f $ruleId, $DriveLetter)
|
||||
}
|
||||
else {
|
||||
$enforced = Invoke-UsbWriteBlockEnforcement -DriveLetter $DriveLetter
|
||||
[void](Show-EnforcementNotification -Title 'DLP: USB заблокирован для записи' -Body $message)
|
||||
}
|
||||
}
|
||||
|
||||
Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'usb_insert' -Data @{
|
||||
@@ -567,8 +632,13 @@ function Evaluate-PrintRules {
|
||||
|
||||
$enforced = $false
|
||||
if ($action -eq 'block') {
|
||||
$enforced = Invoke-PrintJobEnforcement -PrinterName $PrinterName -DocumentName $DocumentName -Owner $Owner
|
||||
Show-EnforcementNotification -Title 'DLP: печать заблокирована' -Body $message
|
||||
if ($script:HeadlessMode) {
|
||||
Write-EndpointLog ("headless fallback: print rule={0} requires block, skipped interactive enforcement printer={1}" -f $ruleId, $PrinterName)
|
||||
}
|
||||
else {
|
||||
$enforced = Invoke-PrintJobEnforcement -PrinterName $PrinterName -DocumentName $DocumentName -Owner $Owner
|
||||
[void](Show-EnforcementNotification -Title 'DLP: печать заблокирована' -Body $message)
|
||||
}
|
||||
}
|
||||
|
||||
Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'print_job' -Data @{
|
||||
@@ -587,6 +657,35 @@ function Test-LooksLikeMojibakeQuestionMarks {
|
||||
return $Value -match '\?{2,}'
|
||||
}
|
||||
|
||||
function Test-IsGenericDocumentName {
|
||||
param([AllowNull()][string]$Value)
|
||||
if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
|
||||
$generic = @(
|
||||
'^\s*Печать документа\s*$',
|
||||
'^\s*Print Document\s*$',
|
||||
'^\s*Document\s*$',
|
||||
'^\s*Документ\s*$',
|
||||
'^\s*Remote Downlevel Document\s*$',
|
||||
'^\s*Local Downlevel Document\s*$',
|
||||
'^\s*Untitled\s*$',
|
||||
'^\s*Без имени\s*$',
|
||||
'^\s*Без названия\s*$'
|
||||
)
|
||||
foreach ($pattern in $generic) {
|
||||
if ($Value -match $pattern) { return $true }
|
||||
}
|
||||
return $false
|
||||
}
|
||||
|
||||
function Test-NeedsBetterDocumentName {
|
||||
param([AllowNull()][string]$Value)
|
||||
if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
|
||||
if (Test-LooksLikeMojibakeQuestionMarks -Value $Value) { return $true }
|
||||
if (Test-IsGenericDocumentName -Value $Value) { return $true }
|
||||
if ($Value -match '^[0-9]+$') { return $true }
|
||||
return $false
|
||||
}
|
||||
|
||||
function Normalize-OwnerForMatch {
|
||||
param([AllowNull()][string]$Value)
|
||||
if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
|
||||
@@ -673,7 +772,7 @@ function Get-PrintServiceDocumentFallback {
|
||||
)
|
||||
|
||||
$preferred = [string]$EventSummary.DocumentName
|
||||
if (-not (Test-LooksLikeMojibakeQuestionMarks -Value $preferred) -and $preferred -notmatch '^[0-9]+$') {
|
||||
if (-not (Test-NeedsBetterDocumentName -Value $preferred)) {
|
||||
return $preferred
|
||||
}
|
||||
|
||||
@@ -686,17 +785,13 @@ function Get-PrintServiceDocumentFallback {
|
||||
if ($candidate -eq $preferred) { continue }
|
||||
if ($Owner -and $candidate -like "*$Owner*") { continue }
|
||||
if ($PrinterName -and $candidate -like "*$PrinterName*") { continue }
|
||||
if (Test-LooksLikeMojibakeQuestionMarks -Value $candidate) { continue }
|
||||
if (Test-NeedsBetterDocumentName -Value $candidate) { continue }
|
||||
|
||||
if ($candidate -match '[\\/:]' -and $candidate -match '\.[A-Za-z0-9]{1,8}$') {
|
||||
$pathCandidates.Add($candidate)
|
||||
continue
|
||||
}
|
||||
|
||||
if ($candidate -match '^[0-9]+$') {
|
||||
continue
|
||||
}
|
||||
|
||||
$textCandidates.Add($candidate)
|
||||
}
|
||||
|
||||
@@ -795,6 +890,7 @@ function Get-BetterDocumentNameFromPrintServiceEvents {
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("printservice fallback failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
|
||||
return $null
|
||||
@@ -804,12 +900,12 @@ $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
|
||||
$resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'ServerHost is required.' }
|
||||
$resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
|
||||
$resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
|
||||
$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
|
||||
$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\AWatch-rus\dlp-policy.json' }
|
||||
$resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
|
||||
$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
|
||||
$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\AWatch-rus\logs' }
|
||||
$resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("endpoint-signals-{0}.log" -f $env:USERNAME) }
|
||||
$resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
|
||||
$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'ActivityWatch-Phase2\\incident-artifacts' }
|
||||
$resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'AWatch-rus\\incident-artifacts' }
|
||||
$resolvedIncidentScreenshotEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'screenshotEnabled') { [bool]$deploymentConfig.incidentCapture.screenshotEnabled } else { $true }
|
||||
|
||||
if ($resolvedLocalAgentLogsEnabled -and -not (Test-Path -LiteralPath $resolvedLogsRoot)) {
|
||||
@@ -839,6 +935,9 @@ Initialize-TransportQueue -QueuePath $queueFile
|
||||
|
||||
Load-DlpPolicy -Path $resolvedPolicyPath
|
||||
Write-EndpointLog ("endpoint collector started against {0}" -f $script:ApiBase)
|
||||
if ($script:HeadlessMode) {
|
||||
Write-EndpointLog "headless mode enabled: enforcement UI is disabled, incident heartbeat and logs only"
|
||||
}
|
||||
|
||||
while ($true) {
|
||||
try {
|
||||
@@ -848,7 +947,7 @@ while ($true) {
|
||||
}
|
||||
|
||||
try {
|
||||
$clipboardText = Get-Clipboard -Raw -ErrorAction SilentlyContinue
|
||||
$clipboardText = Get-ClipboardTextSafe
|
||||
if ($clipboardText) {
|
||||
$clipboardHash = Get-StringHash -Value $clipboardText
|
||||
if ($clipboardHash -and $clipboardHash -ne $script:LastClipboardHash) {
|
||||
@@ -862,6 +961,7 @@ while ($true) {
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("clipboard poll failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
|
||||
try {
|
||||
@@ -889,6 +989,7 @@ while ($true) {
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("usb poll failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
|
||||
try {
|
||||
@@ -899,23 +1000,33 @@ while ($true) {
|
||||
if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
|
||||
$script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
|
||||
|
||||
$printerName = [string]$job.Name
|
||||
$printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
|
||||
$documentName = [string]$job.Document
|
||||
$owner = [string]$job.Owner
|
||||
$documentNameOriginal = $documentName
|
||||
|
||||
if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
|
||||
if (Test-NeedsBetterDocumentName -Value $documentName) {
|
||||
$eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
|
||||
if ($eventDocumentName) {
|
||||
$documentName = $eventDocumentName
|
||||
}
|
||||
}
|
||||
$printDocumentNorm = if ($documentName) { [string]$documentName } else { '' }
|
||||
$printSignalKey = ('{0}|{1}|{2}|{3}' -f
|
||||
(Normalize-PrinterForMatch -Value $printerName),
|
||||
(Normalize-OwnerForMatch -Value $owner),
|
||||
$printDocumentNorm.ToLowerInvariant(),
|
||||
'print_job')
|
||||
if (-not (Should-EmitByCooldown -Fingerprint $printSignalKey -CooldownSeconds 90)) {
|
||||
continue
|
||||
}
|
||||
|
||||
Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
|
||||
printerName = $printerName
|
||||
documentName = $documentName
|
||||
documentNameOriginal = $documentNameOriginal
|
||||
owner = $owner
|
||||
eventSource = 'win32_printjob'
|
||||
}
|
||||
Evaluate-PrintRules -PrinterName $printerName -DocumentName $documentName -Owner $owner
|
||||
}
|
||||
@@ -929,6 +1040,7 @@ while ($true) {
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("printjob poll failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
|
||||
try {
|
||||
@@ -956,6 +1068,17 @@ while ($true) {
|
||||
continue
|
||||
}
|
||||
|
||||
$effectiveDocument = if ($resolvedDocument) { [string]$resolvedDocument } else { [string]$documentName }
|
||||
$printSignalKey = ('{0}|{1}|{2}|{3}' -f
|
||||
(Normalize-PrinterForMatch -Value $printerName),
|
||||
(Normalize-OwnerForMatch -Value $owner),
|
||||
$effectiveDocument.ToLowerInvariant(),
|
||||
'print_job')
|
||||
if (-not (Should-EmitByCooldown -Fingerprint $printSignalKey -CooldownSeconds 90)) {
|
||||
Write-PrintServiceEventTrace -EventSummary $summary -Phase 'skip' -MatchReason 'dedupe-recent-printjob' -ResolvedDocument $resolvedDocument
|
||||
continue
|
||||
}
|
||||
|
||||
Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
|
||||
printerName = $printerName
|
||||
documentName = if ($resolvedDocument) { $resolvedDocument } else { $documentName }
|
||||
@@ -976,6 +1099,7 @@ while ($true) {
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-EndpointLog ("printservice poll failed: {0}" -f $_.Exception.Message)
|
||||
}
|
||||
}
|
||||
catch {
|
||||
|
||||
Reference in New Issue
Block a user