48 lines
3.4 KiB
PowerShell
48 lines
3.4 KiB
PowerShell
function Get-SamsaraStorage {
|
|
param($Result)
|
|
Invoke-SamsaraRead $Result 'Local volumes' {
|
|
$Result.data = @(Get-Volume -ErrorAction Stop | ForEach-Object {
|
|
[pscustomobject]@{ type = 'Volume'; name = [string]$_.FileSystemLabel
|
|
path = if ($_.DriveLetter) { [string]$_.DriveLetter + ':\' } else { [string]$_.Path }
|
|
filesystem = [string]$_.FileSystem; capacity_gib = [math]::Round(([double]$_.Size / 1GB), 2)
|
|
free_gib = [math]::Round(([double]$_.SizeRemaining / 1GB), 2) }
|
|
})
|
|
}
|
|
$Result.limitations += 'Local volume metadata only. Share contents, mounted remote storage, storage-array dependencies, snapshots and backups are not inspected.'
|
|
}
|
|
|
|
function Get-SamsaraShares {
|
|
param($Result)
|
|
Invoke-SamsaraRead $Result 'SMB shares' {
|
|
$Result.data = @(Get-SmbShare -ErrorAction Stop | ForEach-Object {
|
|
[pscustomobject]@{ type = 'SMB Share'; name = [string]$_.Name; path = [string]$_.Path
|
|
capacity_gib = $null; free_gib = $null; special = [bool]$_.Special }
|
|
})
|
|
}
|
|
Invoke-SamsaraRead $Result 'SMB open-file activity' {
|
|
$openFiles = @(Get-SmbOpenFile -ErrorAction Stop)
|
|
$observedAt = Get-SamsaraTimestamp
|
|
foreach ($share in $Result.data) {
|
|
if ($share.name -match '^(ADMIN|IPC|[A-Z])\$$' -or -not $share.path) { continue }
|
|
$prefix = $share.path.TrimEnd([char]'\') + '\'
|
|
$matching = @($openFiles | Where-Object {
|
|
# Path alone also matches a file opened through C$/D$. Require
|
|
# Path = share root + ShareRelativePath to distinguish that case.
|
|
$_.Path -and $_.ShareRelativePath -and
|
|
([string]$_.Path).Equals(($prefix + ([string]$_.ShareRelativePath).TrimStart([char]'\')), [StringComparison]::OrdinalIgnoreCase)
|
|
})
|
|
$adminAliases = @($Result.data | Where-Object {
|
|
$_.name -match '^(ADMIN|IPC|[A-Z])\$$' -and ([string]$_.path).TrimEnd([char]'\').Equals($share.path.TrimEnd([char]'\'), [StringComparison]::OrdinalIgnoreCase)
|
|
})
|
|
# Only aggregated, path-correlated activity is exported. Never serialize
|
|
# open-file objects, file names, session identities or user names.
|
|
$share | Add-Member -NotePropertyName observed_open_files -NotePropertyValue $matching.Count
|
|
$clients = @($matching | Select-Object -ExpandProperty ClientComputerName -Unique)
|
|
$share | Add-Member -NotePropertyName observed_client_count -NotePropertyValue $clients.Count
|
|
$share | Add-Member -NotePropertyName activity_source -NotePropertyValue $(if ($adminAliases.Count) { 'Get-SmbOpenFile (administrative alias ambiguous)' } else { 'Get-SmbOpenFile (share-root-correlated)' })
|
|
$share | Add-Member -NotePropertyName activity_observed_at -NotePropertyValue $observedAt
|
|
}
|
|
}
|
|
$Result.limitations += 'Configured SMB shares, including administrative shares, and aggregate open-file counts share-root-correlated to business shares. No file contents, open-file paths, session identities, ACLs or credentials are exported. Zero open files does not prove a share unused. Same-root aliases are not individually distinguishable; an administrative same-root alias is marked ambiguous and never confirms business-share use. All business shares remain one workload group.'
|
|
}
|