Network shares
Local disk, print, device and IPC shares, their paths and permissions. Shows observed additions, removals and configuration changes.
Topic id: network_shares.
Full inventory every day. Supported changes are reported when the agent observes them.
Fields
The union of live and persistent local disk, print, device and IPC shares. Changes name observed additions, removals, paths and DACL permissions; they provide no actor or exact change time.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.network_shares.share_name | string | Native display spelling of the share name. | |
sparklogs.data.network_shares.path | string | Local path exposed by the share, exactly as Windows returns it: native case and separators, never tokenized. Empty string for authoritative IPC with no path; omitted when unread or registry-only. | |
sparklogs.data.network_shares.share_type | string | Native base share type: disk, print, device, ipc or unknown. Unread for registry-only rows. | |
sparklogs.data.network_shares.share_type_code | integer | Native STYPE_MASK base share type. | |
sparklogs.data.network_shares.special | bool | Native STYPE_SPECIAL flag. | |
sparklogs.data.network_shares.temporary | bool | Native STYPE_TEMPORARY flag. | |
sparklogs.data.network_shares.persistent | bool | Listed in the persistent LanmanServer Shares registry key. | |
sparklogs.data.network_shares.live | bool | Listed by the local server share enumeration. | |
sparklogs.data.network_shares.remark | string | Native share comment, absent when empty or unread. | |
sparklogs.data.network_shares.permissions_sddl | string | DACL-only SDDL. Empty string means the native descriptor is absent (default access); omitted on conversion failure or registry-only rows. |
Changes
This topic reports what the host looks like, so its news is what CHANGED between two reports. Each change below is a named fact you can ask about across the fleet.
Example
Inventory (every day)
7 shares.
sparklogs.data.network_shares.share_name: ADMIN$
sparklogs.data.network_shares.path: D:\Windows
sparklogs.data.network_shares.permissions_sddl: D:(A;;FA;;;SY)(A;;FA;;;BA)
SparkLogs: CONTEXT, Info, network_shares: INVENTORY: 7 shares.
Signal details
network_share_path_changed
The local path exposed by a network share changed.
Severity: Notice by default; configurable from Info through Warning.
Example
network share path changed "Scans". old_path="E \Shared\Scans" new_path="F \Shared\Scans".
sparklogs.instance: network_share:Scans
sparklogs.data.network_shares.share_name: Scans
SparkLogs: network_share_path_changed, Notice, network_shares: network_share_path_changed: NOTABLE: network share path changed "Scans". old_path="E \Shared\Scans" new_path="F \Shared\Scans".
network_share_permissions_changed
A network share's permissions changed.
Severity: Notice by default; configurable from Info through Warning.
Example
network share permissions changed "Scans". old_permissions_sddl="D (A;;FA;;;BA)(A;;0x1301bf;;;AU)" new_permissions_sddl="D (A;;FA;;;BA)(A;;FR;;;AU)".
sparklogs.instance: network_share:Scans
sparklogs.data.network_shares.share_name: Scans
SparkLogs: network_share_permissions_changed, Notice, network_shares: network_share_permissions_changed: NOTABLE: network share permissions changed "Scans". old_permissions_sddl="D (A;;FA;;;BA)(A;;0x1301bf;;;AU)" new_permissions_sddl="D (A;;FA;;;BA)(A;;FR;;;AU)".
network_share_added
A network share was added.
Also reported by: Windows Security event log
Severity: Notice by default; configurable from Info through Warning.
Example
network share added "Reports". old_path="none" new_path="E \Shared\Reports" old_permissions_sddl="none" new_permissions_sddl="D (A;;FA;;;BA)(A;;FR;;;AU)".
sparklogs.instance: network_share:Reports
sparklogs.data.network_shares.share_name: Reports
SparkLogs: network_share_added, Notice, network_shares: network_share_added: NOTABLE: network share added "Reports". old_path="none" new_path="E \Shared\Reports" old_permissions_sddl="none" new_permissions_sddl="D (A;;FA;;;BA)(A;;FR;;;AU)".
network_share_removed
A network share was removed.
Severity: Notice by default; configurable from Info through Warning.
Example
network share removed "Scans". path="E \Shared\Scans" permissions_sddl="D (A;;FA;;;BA)(A;;0x1301bf;;;AU)".
sparklogs.instance: network_share:Scans
sparklogs.data.network_shares.share_name: Scans
SparkLogs: network_share_removed, Notice, network_shares: network_share_removed: NOTABLE: network share removed "Scans". path="E \Shared\Scans" permissions_sddl="D (A;;FA;;;BA)(A;;0x1301bf;;;AU)".