oceans2alaska/Samsara
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace inventory-counting risk with bounded workload scoring and separate confidence

Browse Source
This commit is contained in:
Not Dave
2026-10-30 12:34:39 -07:00
parent f65ade9fff
commit 57e716b710
26 changed files with 10351 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
powershell/Get-ServerStorage.ps1
View File

@@ -19,5 +19,29 @@ function Get-SamsaraShares {
capacity_gib = $null; free_gib = $null; special = [bool]$_.Special }
})
}
$Result.limitations += 'Configured SMB shares, including administrative shares. No share contents, ACLs, credentials, sessions or consumers queried. Existence does not establish use.'
Invoke-SamsaraRead $Result 'SMB open-file activity' {
$openFiles = @(Get-SmbOpenFile -ErrorAction Stop)
$observedAt = Get-SamsaraTimestamp
foreach ($share in $Result.data) {
if ($share.name -match '^(ADMIN|IPC|[A-Z])\$$' -or -not $share.path) { continue }
$prefix = $share.path.TrimEnd([char]'\') + '\'
$matching = @($openFiles | Where-Object {
# Path alone also matches a file opened through C$/D$. Require
# Path = share root + ShareRelativePath to distinguish that case.
$_.Path -and $_.ShareRelativePath -and
([string]$_.Path).Equals(($prefix + ([string]$_.ShareRelativePath).TrimStart([char]'\')), [StringComparison]::OrdinalIgnoreCase)
})
$adminAliases = @($Result.data | Where-Object {
$_.name -match '^(ADMIN|IPC|[A-Z])\$$' -and ([string]$_.path).TrimEnd([char]'\').Equals($share.path.TrimEnd([char]'\'), [StringComparison]::OrdinalIgnoreCase)
})
# Only aggregated, path-correlated activity is exported. Never serialize
# open-file objects, file names, session identities or user names.
$share | Add-Member -NotePropertyName observed_open_files -NotePropertyValue $matching.Count
$clients = @($matching | Select-Object -ExpandProperty ClientComputerName -Unique)
$share | Add-Member -NotePropertyName observed_client_count -NotePropertyValue $clients.Count
$share | Add-Member -NotePropertyName activity_source -NotePropertyValue $(if ($adminAliases.Count) { 'Get-SmbOpenFile (administrative alias ambiguous)' } else { 'Get-SmbOpenFile (share-root-correlated)' })
$share | Add-Member -NotePropertyName activity_observed_at -NotePropertyValue $observedAt
}
}
$Result.limitations += 'Configured SMB shares, including administrative shares, and aggregate open-file counts share-root-correlated to business shares. No file contents, open-file paths, session identities, ACLs or credentials are exported. Zero open files does not prove a share unused. Same-root aliases are not individually distinguishable; an administrative same-root alias is marked ambiguous and never confirms business-share use. All business shares remain one workload group.'
}

4
powershell/README.md
View File

@@ -12,7 +12,7 @@ Targets: Windows Server 2016/2019/2022/2025, Windows PowerShell 5.1, 64-bit exec
| Get-ServerNetwork.ps1 | Get-NetTCPConnection and Get-Process names/IDs |
| Get-ServerTasks.ps1 | Get-ScheduledTask visible definitions, accounts, safe executable basenames, selected triggers |
| Get-ServerSoftware.ps1 | HKLM uninstall registrations using explicit Registry32/Registry64 read-only handles |
| Get-ServerStorage.ps1 | Get-Volume and Get-SmbShare; volumes/shares share the existing storage inventory category |
| Get-ServerStorage.ps1 | Get-Volume, Get-SmbShare and aggregate Get-SmbOpenFile share-root correlation; volumes/shares share the existing storage inventory category |
| Get-ServerCertificates.ps1 | Public metadata in accessible LocalMachine certificate stores |
| Inventory.Common.ps1 | Section timing, safe errors and permission limitations |
@@ -25,3 +25,5 @@ Direct full-script use has no Python timeout/cancellation supervisor; use the Py
See README.md for exact GUI, headless and real-host validation instructions. `tests/powershell/Test-Collectors.ps1` parses scripts and mocks their data sources; this is synthetic testing, not real host validation.
Implementation references: [Get-WindowsFeature](https://learn.microsoft.com/en-us/powershell/module/servermanager/get-windowsfeature), [Win32_Service](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service), [Get-NetTCPConnection](https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection), [Get-ScheduledTask](https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask), [registry software inventory](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-software-installations), [certificate provider](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/about/about_certificate_provider).
Scoring v2 excludes default administrative shares, but keeps them in inventory. Business-share client confirmation requires share-root-correlated open-file counts, not just TCP 445 activity. The read-only activity query exports no file names, session users or client names; same-root administrative aliases remain ambiguous. See docs/SCORING.md. This new query still requires native Windows validation.