oceans2alaska/Samsara
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace inventory-counting risk with bounded workload scoring and separate confidence

Browse Source
This commit is contained in:
Not Dave
2026-10-30 12:34:39 -07:00
parent f65ade9fff
commit 57e716b710
26 changed files with 10351 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/powershell/Test-Collectors.ps1
View File

@@ -33,6 +33,11 @@ function Get-ScheduledTask {
}
function Get-Volume { [CmdletBinding()] param() [pscustomobject]@{ FileSystemLabel='Synthetic OS'; DriveLetter='C'; Path='C:\'; FileSystem='NTFS'; Size=100GB; SizeRemaining=50GB } }
function Get-SmbShare { [CmdletBinding()] param() [pscustomobject]@{ Name='SyntheticReports'; Path='C:\Reports'; Special=$false } }
function Get-SmbOpenFile {
[CmdletBinding()] param()
[pscustomobject]@{ Path='C:\Reports\SECRET-file.txt'; ShareRelativePath='SECRET-file.txt'; ClientComputerName='192.0.2.21'; ClientUserName='SECRET' }
[pscustomobject]@{ Path='C:\Reports\SECRET-admin.txt'; ShareRelativePath='Reports\SECRET-admin.txt'; ClientComputerName='192.0.2.21'; ClientUserName='SECRET' }
}
function Get-ChildItem {
[CmdletBinding()] param($LiteralPath)
if ($LiteralPath -eq 'Cert:\LocalMachine') { [pscustomobject]@{ PSPath='Cert:\LocalMachine\My'; PSChildName='My' } }
@@ -51,6 +56,7 @@ foreach ($name in $collectors.Keys) {
Assert-True ($section.started_at -and $section.completed_at) 'Missing timestamps'
Assert-True (($section | ConvertTo-Json -Depth 12) -notmatch 'SECRET') 'Secret field serialized'
if ($name -eq 'network') { Assert-True ($section.data[0].process -eq 'SyntheticWorker') 'Process correlation failed' }
if ($name -eq 'shares') { Assert-True ($section.data[0].observed_open_files -eq 1) 'Share activity correlation missing' }
if ($name -eq 'tasks') { Assert-True ($section.data[0].executables -eq 'report.exe') 'Executable basename missing' }
}
foreach ($build in @('14393','17763','20348','26100')) {
@@ -69,7 +75,7 @@ $section=Invoke-SamsaraSection 'software' {param($r) Invoke-SamsaraRead $r 'Synt
Assert-True ($section.status -eq 'complete' -and $section.data[0].name -eq 'Synthetic application') 'Registry metadata projection failed'
function Get-SmbShare { [CmdletBinding()] param() throw [UnauthorizedAccessException]::new('SECRET protected details') }
$section=Invoke-SamsaraSection 'shares' {param($r) Get-SamsaraShares $r}
Assert-True ($section.status -eq 'failed') 'Denied collection was not failed'
Assert-True ($section.status -eq 'partial' -and $section.data.Count -eq 0) 'Denied share enumeration was not partial/empty'
Assert-True ($section.errors[0].code -eq 'access_denied') 'Permission error not categorized'
Assert-True (($section | ConvertTo-Json -Depth 12) -notmatch 'SECRET') 'Raw error exposed'
$script:SamsaraIsElevated=$false