The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Available Folders via SMB or AFP

Description: Folders available to others via SMB or AFP

What The Data Shows: Ensure available shares conform to policy

SQL: 

SELECT * 
FROM shared_folders;

 

  

0 Votes
4 Comments
Query_Admin
Community Manager
Community Manager
Status changed to: Approved
 
mrpeters22
Contributor III

Checked this today and that table does not seem to exist in the current osquery schema, however with an 'osqueryi.exe > .tables' check, it appears the table we're after is 'shared_resources'

 

SELECT * 

FROM shared_resources; 

 

tmccormack
Carbon Black Employee
Status changed to: Under Review

Hi @mrpeters22 the shared_folders table is for mac only, are you looking for a similar query for Windows? Then yes, shared_resources is the right table.

mrpeters22
Contributor III

@tmccormackthis is perfect - thank you for the quick response. Yes, this was on a Windows device :)

Have a great day!