Network Shares Inventory

For every managed machine, Athena inventories the shared folders that machine exposes to the network — Windows SMB file shares, Linux Samba shares, and NFS exports. This gives you a fleet-wide answer to "where is data being shared, and from which folder?" without logging on to each endpoint, so you can review unexpected or forgotten shares as part of a security or data-governance pass.

This is read-only discovery. Athena reports the shares each machine already publishes; it does not create, remove, or reconfigure shares and it does not change share permissions. To add or remove a share, run a remote command or a deployment that makes the change on the endpoint.

What's collected#

For each machine, Athena records every shared folder the endpoint publishes and, for each share, the following:

Field	Meaning
Share Name	The name the share is published under — for example `Data` or `Public`. On Windows this is the SMB share name; on Linux it is the Samba share name, or for an NFS export the final path segment of the exported directory.
Path	The local folder on the machine that the share maps to — for example `D:\Data` on Windows or `/srv/data` on Linux.
Description	Descriptive text for the share. Windows shares carry the share's comment/description. For a Linux share, Athena records the share type and target — for a Samba share the shared path, and for an NFS export the client list the directory is exported to.
Status	Whether the share is Active or Inactive. Discovered shares are reported as Active.

Shares published by the machine, not shares it maps. This inventory lists the folders the endpoint exposes to other computers. It does not list drives the machine has mounted from elsewhere (for example a mapped network drive or a remotely mounted NFS volume).

Platform coverage#

Network shares are collected on both Windows and Linux endpoints, using each operating system's native facilities, so a mixed fleet answers the same question consistently.

Aspect	Windows	Linux
Share types	SMB file shares published by the machine.	Samba (SMB) shares and NFS exports.
Where it reads from	The machine's shared-folder configuration.	The Samba configuration (`/etc/samba/smb.conf` or `/etc/smb.conf`) and the NFS exports file (`/etc/exports`).
Description	The share comment/description.	The share type plus the shared path (Samba) or the exported-to client list (NFS).

Linux Samba shares. On Linux, Athena reads the shares defined in the Samba configuration file. The standard non-file-share sections — [global], [homes], [printers], and [print$] — are treated as configuration rather than data shares and are not listed. Only sections that define a shared path are reported.

Where to see it#

Open a machine from the Agents list, then in the agent detail view's left-hand navigation choose Network Shares. The section lists every shared folder in a table with four columns — Share Name, Path, Description, and Status. When a machine publishes no shares, the section shows "No network shares found on this system".

Like the rest of inventory, the values reflect the machine's last successful collection on its regular reporting cadence rather than a live query at open time. For the wider inventory surface and refresh behaviour, see Inventory.

Scope note. Network shares are a per-machine inventory field, viewed on a machine's detail view. They are not currently one of the fields you can build a dynamic collection, an automatic tag, or a report-builder column from. If you need a fleet-wide rule (for example, "flag any machine that publishes an unexpected share"), evaluate it on the endpoint with a compliance rule or a custom scan and surface the answer through the scan results — which you can then use in collections, tagging, and reports like any other collected field.

Reading it over the API#

Network shares are part of an agent's full inventory. Fetch the complete inventory document and read the networkShares array:

# Fetch the full inventory for one agent, then inspect its published shares
$headers = @{ Authorization = "Bearer $token" }

$inv = Invoke-RestMethod `
  -Uri "https://athena.example.com:8443/api/agents/$agentId/inventory" `
  -Headers $headers `
  -SkipCertificateCheck

# List every published share and the folder it maps to
$inv.data.networkShares |
  Select-Object shareName, path, shareType, description, isActive

Each element of networkShares carries shareName, path, description, isActive, and shareType (for example SMB or NFS on Linux). Reading inventory requires the Helpdesk role or higher. The networkShares array is empty or absent when a machine publishes no shares or has not yet reported this data.

The strongly-typed PowerShell module cmdlet Get-AthenaAgentInventory returns the same full inventory document. For the wider inventory surface, the per-area sub-routes, and how a refresh is triggered, see Inventory.