oceans2alaska
610a3bb447
- Add privacy projection (core/privacy.py), private report storage, bounded
process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
"Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Local Windows Server collection
Read-only collection commands for supported Server release builds 2016/2019/2022/2025. The Python workflow launches fixed sections using system Windows PowerShell 5.1, NoProfile, fixed argument lists, bounded memory output and time/cancellation limits. No remoting/configuration, execution-policy bypass, elevation or credential storage. Actual Windows runtime/least-privilege acceptance is still pending.
The bundled samsara/assets/privacy_policy.json and privacy_catalogue.json are
required. Protect the deployment against unauthorized changes. Name/path projection
occurs before PowerShell JSON output and again at Python UI/report boundaries.
| Module | Default queries | Privacy/coverage limits |
|---|---|---|
| System | Local OS/build/boot, domain-joined boolean, adapter IPs | Fixed OS labels, opaque identities; no domain string/adapter description requested |
| Roles | Get-WindowsFeature installed identifiers | Canonical/opaque names; no active-use assertion |
| Services | Win32_Service Name, State, StartMode, ProcessId | No StartName, DisplayName, PathName; names canonical/opaque |
| Network | Get-Process names/PIDs, Get-NetTCPConnection | No command lines; names canonical/opaque; historical direction unverified |
| Tasks | MSFT_ScheduledTask TaskName, TaskPath, State only | Opaque identities/category; no Actions, Principals, Triggers, Settings, XML or arguments requested; partial |
| Software | Read-only HKLM uninstall registry views | DoNotExpandEnvironmentNames; canonical/opaque display name, numeric version; no installer query |
| Storage | Fixed Win32_LogicalDisk size/free/filesystem/drive metadata | No labels, mount-only volumes or child paths; partial |
| Shares | Get-SmbShare configured roots | Only exact reviewed local roots retained; no Get-SmbOpenFile or session enumeration; partial |
| Certificates | No provider call | not_collected pending a separately approved minimal design |
Provider-returned strings may enter process memory before projection; explicit properties do not prove that native provider internals process no other metadata. The application cannot promise PHI-free memory or zero incidental OS writes. Permission failures have categorical errors, timestamps and limitations; no raw exception messages are returned. Missing evidence must never imply inactivity.
Prefer the Python CLI and its configured private local report folder. Direct driver output is not supervised by Python's bounds or secure writer: do not use arbitrary shell redirects on production hosts. See privacy setup and native validation.
tests/powershell/Test-Collectors.ps1 parses ASTs and invokes synthetic mocked
providers only. It makes forbidden certificate, open-file, full-task and label
enumeration fail. Run on an authorized lab host with its existing script policy;
no real collector runs in that test. A passing mock test is not real-host acceptance.