oceans2alaska
610a3bb447
- Add privacy projection (core/privacy.py), private report storage, bounded
process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
"Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
39 lines
2.9 KiB
Markdown
39 lines
2.9 KiB
Markdown
# Local Windows Server collection
|
|
|
|
Read-only collection commands for supported Server release builds 2016/2019/2022/2025.
|
|
The Python workflow launches fixed sections using system Windows PowerShell 5.1,
|
|
NoProfile, fixed argument lists, bounded memory output and time/cancellation limits.
|
|
No remoting/configuration, execution-policy bypass, elevation or credential storage.
|
|
Actual Windows runtime/least-privilege acceptance is still pending.
|
|
|
|
The bundled `samsara/assets/privacy_policy.json` and `privacy_catalogue.json` are
|
|
required. Protect the deployment against unauthorized changes. Name/path projection
|
|
occurs before PowerShell JSON output and again at Python UI/report boundaries.
|
|
|
|
| Module | Default queries | Privacy/coverage limits |
|
|
| --- | --- | --- |
|
|
| System | Local OS/build/boot, domain-joined boolean, adapter IPs | Fixed OS labels, opaque identities; no domain string/adapter description requested |
|
|
| Roles | Get-WindowsFeature installed identifiers | Canonical/opaque names; no active-use assertion |
|
|
| Services | Win32_Service Name, State, StartMode, ProcessId | No StartName, DisplayName, PathName; names canonical/opaque |
|
|
| Network | Get-Process names/PIDs, Get-NetTCPConnection | No command lines; names canonical/opaque; historical direction unverified |
|
|
| Tasks | MSFT_ScheduledTask TaskName, TaskPath, State only | Opaque identities/category; no Actions, Principals, Triggers, Settings, XML or arguments requested; partial |
|
|
| Software | Read-only HKLM uninstall registry views | DoNotExpandEnvironmentNames; canonical/opaque display name, numeric version; no installer query |
|
|
| Storage | Fixed Win32_LogicalDisk size/free/filesystem/drive metadata | No labels, mount-only volumes or child paths; partial |
|
|
| Shares | Get-SmbShare configured roots | Only exact reviewed local roots retained; no Get-SmbOpenFile or session enumeration; partial |
|
|
| Certificates | No provider call | not_collected pending a separately approved minimal design |
|
|
|
|
Provider-returned strings may enter process memory before projection; explicit
|
|
properties do not prove that native provider internals process no other metadata.
|
|
The application cannot promise PHI-free memory or zero incidental OS writes.
|
|
Permission failures have categorical errors, timestamps and limitations; no raw
|
|
exception messages are returned. Missing evidence must never imply inactivity.
|
|
|
|
Prefer the Python CLI and its configured private local report folder. Direct driver
|
|
output is not supervised by Python's bounds or secure writer: do not use arbitrary
|
|
shell redirects on production hosts. See [privacy setup and native validation](../docs/PRIVACY_HARDENING.md).
|
|
|
|
`tests/powershell/Test-Collectors.ps1` parses ASTs and invokes synthetic mocked
|
|
providers only. It makes forbidden certificate, open-file, full-task and label
|
|
enumeration fail. Run on an authorized lab host with its existing script policy;
|
|
no real collector runs in that test. A passing mock test is not real-host acceptance.
|