Santa (Google)

com.google.santa

Santa settings

macOS

Configuration Keys (42)

Showing 42 of 42 keys

Key	Type	Description	Default	Range
`PFC_SegmentedControl_0`string required	string	—	Default: —	Range: —
`ClientMode`integer Client Mode	integer	—	Default: 1	Range: Monitor (1), Lockdown (2)
`FailClosed`boolean Deny on Read Error	boolean	Deny execution in LOCKDOWN mode if there is an error reading or processing an executable file.	Default: false	Range: —
`FileChangesRegex`string File Changes Regex	string	Path regexes (ICU format) to monitor for file changes.	Default: —	Range: —
`AllowedPathRegex`string Allowed Path Regex	string	Path regexes (ICU format) of binaries to allow. Lower precedent than binary, certificate, and Team ID scopes.	Default: —	Range: —
`BlockedPathRegex`string Blocked Path Regex	string	Path regexes (ICU format) of binaries to block. Lower precedent than binary, certificate, and Team ID scopes.	Default: —	Range: —
`EnableBadSignatureProtection`boolean Bad Signature Protection	boolean	Block binaries with a bad signing chain, unless explicitly allowed.	Default: false	Range: —
`EnablePageZeroProtection`boolean Enable Page Zero Protection	boolean	Block 32-bit binaries missing the __PAGEZERO segment, unless explicitly allowed.	Default: true	Range: —
`EnableSysxCache`boolean Enable Sysx Cache	boolean	Enable secondary cache. Improves performance when multiple EndpointSecurity system extensions are installed.	Default: true	Range: —
`AboutText`string About Text	string	Custom text to display at launch.	Default: —	Range: —
`MoreInfoURL`string More Info URL	string	Optional "More Info..." link.	Default: —	Range: —
`EventDetailURL`string Event Detail URL	string	The URL to open when the user gets a block notification. If unset, the button will not be displayed. Can include the following variables for substitution: %file_identifier% - SHA-256 of the file that was blocked %bundle_or_file_identifier% - SHA-256 of the file that was blocked or the bundle containing it, if available %file_sha% - Deprecated, acts like bundle_or_file_identifier %machine_id% - ID of the machine %username% - The executing user %serial% - System's serial number %uuid% - System's UUID %hostname% - System's full hostname	Default: —	Range: —
`EventDetailText`string Event Detail Text	string	The text of the button for Event Detail URL.	Default: —	Range: —
`UnknownBlockMessage`string Unknown Block Message	string	Custom message when an unknown binary is blocked.	Default: —	Range: —
`BannedBlockMessage`string Banned Block Message	string	Custom message when a binary is blocked by a rule.	Default: —	Range: —
`ModeNotificationMonitor`string Monitor Notification Text	string	Custom message when entering MONITOR mode.	Default: —	Range: —
`ModeNotificationLockdown`string Lockdown Notification Text	string	Custom message when entering LOCKDOWN mode.	Default: —	Range: —
`SyncBaseURL`string Sync Server URL	string	—	Default: —	Range: —
`SyncEnableCleanSyncEventUpload`boolean Enable Upload Clean Syncs	boolean	Upload events to the sync server even if a clean sync is requested.	Default: false	Range: —
`ClientAuthCertificateFile`string Client Certificate File Path	string	Location of a PKCS#12 certificate to be used for sync authentication.	Default: —	Range: —
`ClientAuthCertificatePassword`string Client Certificate Password	string	—	Default: —	Range: —
`ClientAuthCertificateCN`string Client Certificate Common Name	string	The Common Name of a certificate in the System keychain to be used for sync authentication.	Default: —	Range: —
`ClientAuthCertificateIssuerCN`string Client Certificate Issuer Common Name	string	The Issuer Name of a certificate in the System keychain to be used for sync authentication.	Default: —	Range: —
`ServerAuthRootsData`data Server Authentication Certificate Roots	data	X.509 certificate (.pem) for inclusion on device. A valid PEM containing one or more certificates to be used for certificate pinning.	Default: —	Range: —
`ServerAuthRootsFile`string Server Authentication Certificate Roots (Local)	string	Path to an on-disk X.509 certificate (.pem). A valid PEM containing one or more certificates to be used for certificate pinning.	Default: —	Range: —
`MachineOwner`string Machine Owner	string	—	Default: —	Range: —
`MachineID`string Machine ID	string	—	Default: —	Range: —
`MachineOwnerPlist`string Machine Owner Plist	string	The path to a plist that contains the MachineOwnerKey / value pair.	Default: —	Range: —
`MachineOwnerKey`string Machine Owner Key	string	The key to use on Machine Owner Plist.	Default: —	Range: —
`MachineIDPlist`string Machine ID Plist	string	The path to a plist that contains the MachineOwnerKey / value pair.	Default: —	Range: —
`MachineIDKey`string Machine ID Key	string	The key to use on Machine ID Plist.	Default: —	Range: —
`EventLogType`string Event Log Type	string	syslog: Sent to ASL or ULS (if built with the 10.12 SDK or later); filelog: Sent to a file on disk. Use EventLogPath to specify a path.	Default: "filelog"	Range: System log (syslog), File (filelog), Mail (protobuf), None ()
`EventLogPath`string Event Log Path	string	— Depends on: EventLogType ∈ [filelog]	Default: "/var/db/santa/santa.log"	Range: —
`MailDirectory`string Mail Directory	string	The base directory used to save mail files. Depends on: EventLogType ∈ [protobuf]	Default: "/var/db/santa/mail"	Range: —
`MailDirectoryFileSizeThresholdKB`integer Mail Max File Size	integer	Per-file size limit (KB) for files stored in the event log mail directory.	Default: 100	Range: —
`MailDirectorySizeThresholdMB`integer Mail Max Size	integer	Total file size limit (MB) for all files stored in the event log mail directory.	Default: 500	Range: —
`MailDirectoryEventMaxFlushTimeSec`integer Mail Max Event Buffer	integer	Maximum time (seconds) events will stay buffered in memory before being flushed to disk.	Default: 5	Range: —
`EnableMachineIDDecoration`boolean Enable Machine ID Decoration	boolean	Appends the MachineID to the end of each log line if enabled.	Default: false	Range: —
`MetricFormat`string Metric Format	string	The key to use on Machine ID Plist.	Default: ""	Range: Raw JSON (rawjson), Monarch JSON (monarchjson), None ()
`MetricURL`string Metric URL	string	URL describing where monitoring metrics should be exported.	Default: —	Range: —
`MetricExportInterval`integer Metric Export Interval	integer	Time (seconds) between exporting metrics.	Default: 30	Range: —
`MetricExportTimeout`integer Metric Export Timeout	integer	Timeout (seconds) for exporting metrics.	Default: 30	Range: —