ato-source-smb

Collect NIST 800-53 audit evidence from SMB shares by mounting read-only shares across macOS/Linux or accessing UNC paths on Windows. The process applies depth-limited traversal and file-type filtering to map matched files to control families, producing an evidence batch and citations file.

Yes, you can scan Windows UNC paths for compliance evidence without altering source files. The workflow mounts read-only shares, discovers relevant files based on configured filters, and copies them to an evidence store while emitting a structured citation batch with provenance.

Automate forensics evidence gathering across macOS and Linux SMB shares using OS detection to mount read-only shares. The system applies depth-limited traversal and per-share configuration to curate relevant evidence, automatically copying discovered files and emitting structured citations.

SMB evidence collection enforces ambient-auth by default but supports optional pre-authenticated mounting via an auth-config setup. This allows secure, read-only access to file shares for compliance and security investigations while maintaining provenance.

If partial failures occur during SMB file share evidence collection, the system guarantees unmount and captures the errors in the citation batch. This ensures error reporting is maintained alongside the successfully collected evidence batch.

Configure depth-limited traversal and file-type filtering for SMB compliance scans by setting per-share parameters before running the workflow. This curation process ensures only relevant files are mapped to NIST 800-53 control families and copied to the evidence store.