oceans2alaska/Samsara
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace inventory-counting risk with bounded workload scoring and separate confidence

Browse Source
This commit is contained in:
Not Dave
2026-10-30 12:34:39 -07:00
parent f65ade9fff
commit 57e716b710
26 changed files with 10351 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
powershell/README.md
View File

@@ -12,7 +12,7 @@ Targets: Windows Server 2016/2019/2022/2025, Windows PowerShell 5.1, 64-bit exec
| Get-ServerNetwork.ps1 | Get-NetTCPConnection and Get-Process names/IDs |
| Get-ServerTasks.ps1 | Get-ScheduledTask visible definitions, accounts, safe executable basenames, selected triggers |
| Get-ServerSoftware.ps1 | HKLM uninstall registrations using explicit Registry32/Registry64 read-only handles |
| Get-ServerStorage.ps1 | Get-Volume and Get-SmbShare; volumes/shares share the existing storage inventory category |
| Get-ServerStorage.ps1 | Get-Volume, Get-SmbShare and aggregate Get-SmbOpenFile share-root correlation; volumes/shares share the existing storage inventory category |
| Get-ServerCertificates.ps1 | Public metadata in accessible LocalMachine certificate stores |
| Inventory.Common.ps1 | Section timing, safe errors and permission limitations |
@@ -25,3 +25,5 @@ Direct full-script use has no Python timeout/cancellation supervisor; use the Py
See README.md for exact GUI, headless and real-host validation instructions. `tests/powershell/Test-Collectors.ps1` parses scripts and mocks their data sources; this is synthetic testing, not real host validation.
Implementation references: [Get-WindowsFeature](https://learn.microsoft.com/en-us/powershell/module/servermanager/get-windowsfeature), [Win32_Service](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service), [Get-NetTCPConnection](https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection), [Get-ScheduledTask](https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask), [registry software inventory](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-software-installations), [certificate provider](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/about/about_certificate_provider).
Scoring v2 excludes default administrative shares, but keeps them in inventory. Business-share client confirmation requires share-root-correlated open-file counts, not just TCP 445 activity. The read-only activity query exports no file names, session users or client names; same-root administrative aliases remain ambiguous. See docs/SCORING.md. This new query still requires native Windows validation.