Rename application to Samsara and add assessment summary, detailed tabs and local Linux inventory

samsara/analyzers/__init__.py

@@ -0,0 +1 @@
+

samsara/analyzers/assessment.py

@@ -0,0 +1,44 @@
+def assess(data):
+    inventory = data["inventory"]
+    findings = []
+    def add(category, classification, evidence, severity, points):
+        findings.append(dict(category=category, classification=classification, evidence=evidence,
+                             severity=severity, points=points))
+    for row in inventory.get("roles", []):
+        add("Installed role", "Potential dependency", row["name"], "medium", 10)
+    linux_apps = ('nginx', 'apache2', 'httpd', 'mysql', 'mysqld', 'mariadb', 'postgresql',
+                  'redis', 'docker', 'containerd', 'smbd', 'smb', 'nfs-server', 'named', 'haproxy', 'tomcat')
+    unclassified = []
+    for row in inventory.get("services", []):
+        if row.get("state") == "Running":
+            if data['server'].get('platform') == 'linux' and not any(
+                row['name'].split('@')[0].split('.')[0] == app or row['name'].startswith(app + '-')
+                for app in linux_apps
+            ):
+                unclassified.append(row['name'])
+                continue
+            add("Active service", "Potential dependency", f"{row['name']} running as {row.get('account', 'unknown')}", "medium", 10)
+    if unclassified:
+        add("Unclassified services", "Unknown or insufficient evidence",
+            f"{len(unclassified)} running Linux services lack an application rule. Administrator review required; examples: " + ', '.join(unclassified[:8]), "low", 5)
+    for row in inventory.get("network", []):
+        if row.get("state") == "Established":
+            add("Network activity", "Confirmed observed activity", f"{row['local_address']}:{row['local_port']} ↔ {row['remote_address']}:{row['remote_port']}; direction unverified", "high", 20)
+        elif row.get("state") == "Listen":
+            add("Listening port", "Potential dependency", f"TCP {row['local_port']} ({row.get('process', 'unknown')})", "medium", 5)
+    for row in inventory.get("tasks", []):
+        if row.get("enabled"):
+            add("Scheduled workload", "Potential dependency", f"{row['name']}; account {row.get('account', 'unknown')}", "medium", 10)
+    for row in inventory.get("storage", []):
+        if row.get("type") in ("SMB Share", "NFS Export", "Samba Share"):
+            add("Shared storage", "Potential dependency", f"{row['name']}: {row['path']}", "high", 15)
+    for row in inventory.get("storage", []):
+        if row.get("type") == "Remote Mount":
+            add("Remote storage consumer", "Potential dependency", f"{row['name']} mounted at {row['path']}; access and use unverified", "medium", 10)
+    for name, check in data["checks"].items():
+        if check["status"] != "complete":
+            add("Missing evidence", "Unknown or insufficient evidence", f"{name}: {check['message']}", "medium", 10)
+    add("Observation limits", "Unknown or insufficient evidence", "Point-in-time inventory cannot establish infrequent, offline, historical or external dependencies. No active connections does not prove a server is unused.", "low", 5)
+    score = min(100, sum(f["points"] for f in findings))
+    level = "critical" if score >= 90 else "high" if score >= 60 else "medium" if score >= 30 else "low" if score else "informational"
+    return {"score": score, "level": level, "findings": findings}

samsara/analyzers/summary.py

@@ -0,0 +1,34 @@
+"""Compact, evidence-based presentation of the full assessment."""
+import re
+
+# Name hints for server workloads, not a comprehensive application classifier.
+WORKLOAD = re.compile(r'(?:nginx|apache|httpd|iis|w3svc|sql|postgres|mariadb|mysql|redis|mongo|oracle|tomcat|haproxy|docker|containerd|podman|samba|smbd|nfs|bind|named|rabbitmq|kafka|jenkins|backup|reporting)', re.I)
+
+
+def summarize(data, assessment):
+    server, inventory = data['server'], data['inventory']
+    os_name = str(server.get('operating_system') or 'Not collected')
+    version = server.get('os_version')
+    if not version:
+        match = re.search(r'\b(?:20\d{2}|\d+(?:\.\d+)+)\b', os_name)
+        version = match[0] if match else 'Not collected'
+    version = str(version)
+    important = []
+    for row in inventory.get('software', []):
+        if WORKLOAD.search(row['name']) and not row['name'].lower().startswith('lib') and not row['name'].lower().endswith(('-dev', '-devel', '-doc')):
+            important.append({'name': row['name'], 'version': row.get('version', 'Not collected'),
+                              'evidence': 'Installed software name matches a server-workload hint; use unverified'})
+    names = {row['name'].lower().split(':')[0] for row in important}
+    for row in inventory.get('services', []):
+        if row.get('state') == 'Running' and WORKLOAD.search(row['name']) and row['name'].lower().removesuffix('.service') not in names:
+            important.append({'name': row['name'], 'version': 'Not collected', 'evidence': 'Running service; application ownership requires review'})
+    jobs = []
+    for row in inventory.get('tasks', []):
+        if row.get('enabled') or row.get('state') == 'Running':
+            jobs.append({'name': row['name'], 'schedule': row.get('triggers', 'Schedule not collected'),
+                         'status': row.get('state', 'Enabled schedule; execution unverified'),
+                         'account': row.get('account', 'Not collected')})
+    return {'os_type': os_name, 'version': version,
+            'risk_score': assessment['score'], 'risk_level': assessment['level'],
+            'software': important, 'jobs': jobs,
+            'incomplete': sum(check['status'] != 'complete' for check in data['checks'].values())}