Snaffler

Separate share visibility from file-content findings. A rule match is a review candidate, not proof of a valid credential or a severity rating.

Workflow

1. Record the executable version and identity. Use upstream releases and the matching option definitions.
2. Choose host discovery, an explicit host list, or a local directory. Start with share listing when file contents are unnecessary.
3. Keep the results and effective rules together. Review matches before assigning impact.

# Share listing only for explicit hosts
.\Snaffler.exe -s -n fileserver1,fileserver2 -a -o shares.log

# Audit a local fixture without computer/share discovery
.\Snaffler.exe -s -i C:\audit-fixture -o findings.log -v data

# TSV is a switch; -o supplies the filename
.\Snaffler.exe -s -n fileserver1 -a -y -o shares.tsv