oceans2alaska
b4c0cf12ca
Add a `retain` block to privacy_policy.json (all on by default) so assessments show software, services, processes, tasks, shares/mounts and private peer IPs. Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset, length, path depth). Accounts, command lines, child paths, filenames and public peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated; tests cover retention, withholding and all-switches-off. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
37 lines
2.4 KiB
PowerShell
37 lines
2.4 KiB
PowerShell
function Get-SamsaraSystem {
|
|
param($Result)
|
|
$Result.data = [ordered]@{
|
|
hostname = 'Host-0001'; platform = 'windows'
|
|
collection_source = 'Local Windows read-only collection'
|
|
operating_system = 'Not collected'; os_version = 'Not collected'; os_build = 'Not collected'
|
|
product_type = 0; last_boot = 'Not collected'; ip_addresses = @(); network_adapters = @()
|
|
domain = 'Not collected'; domain_joined = $null
|
|
}
|
|
Get-SamsaraPrivacyConfiguration
|
|
if (($script:SamsaraPrivacy.approved_hostnames -ccontains [Environment]::MachineName) -or (Test-SamsaraRetain 'hostname' ([Environment]::MachineName))) { $Result.data.hostname = [Environment]::MachineName }
|
|
Invoke-SamsaraRead $Result 'OS identity' {
|
|
$os = Get-CimInstance -ClassName Win32_OperatingSystem -Property Version,BuildNumber,LastBootUpTime,ProductType -ErrorAction Stop
|
|
$years = @{ '14393' = '2016'; '17763' = '2019'; '20348' = '2022'; '26100' = '2025' }
|
|
if ([int]$os.ProductType -notin @(2,3) -or -not $years.ContainsKey([string]$os.BuildNumber)) {
|
|
throw 'Unsupported Windows release or workstation edition.'
|
|
}
|
|
$Result.data.operating_system = 'Windows Server ' + $years[[string]$os.BuildNumber]
|
|
$Result.data.os_version = $years[[string]$os.BuildNumber]
|
|
$Result.data.os_build = [string]$os.BuildNumber
|
|
$Result.data.kernel_version = [string]$os.Version
|
|
$Result.data.product_type = [int]$os.ProductType
|
|
$Result.data.last_boot = $os.LastBootUpTime.ToUniversalTime().ToString('o')
|
|
}
|
|
Invoke-SamsaraRead $Result 'Computer domain membership' {
|
|
$computer = Get-CimInstance -ClassName Win32_ComputerSystem -Property PartOfDomain -ErrorAction Stop
|
|
$Result.data.domain = 'Domain identity omitted'
|
|
$Result.data.domain_joined = [bool]$computer.PartOfDomain
|
|
}
|
|
Invoke-SamsaraRead $Result 'Network adapter configuration' {
|
|
$adapters = @(Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' -Property IPAddress -ErrorAction Stop)
|
|
$Result.data.network_adapters = @($adapters | ForEach-Object -Begin { $i = 0 } -Process { $i++; 'Adapter-' + $i })
|
|
$Result.data.ip_addresses = @($adapters | ForEach-Object { foreach ($address in $_.IPAddress) { [string]$address } })
|
|
}
|
|
$Result.limitations += 'Identity and addresses are local observations. No DNS probes or Active Directory enrichment were performed.'
|
|
}
|