Santa (North Pole Security)

com.northpolesec.santa

Santa settings

macOS

Configuration Keys (90)

Showing 90 of 90 keys

Key	Type	Description	Default	Range
`PFC_SegmentedControl_0`string required	string	—	Default: —	Range: —
`ClientMode`integer Client Mode	integer	The client mode that Santa should operate in.	Default: 1	Range: Monitor (1), Lockdown (2), Standalone (3)
`FailClosed`boolean Deny on Read Error	boolean	Deny execution in LOCKDOWN mode if there is an error reading or processing an executable file.	Default: false	Range: —
`FileChangesRegex`string File Changes Regex	string	Path regexes (ICU format) to monitor for file changes.	Default: —	Range: —
`FileChangesPrefixFilters`array File Changes Prefix Filters	array	Path prefixes to exclude from file change logging.	Default: —	Range: —
string Path Prefix	string	—	Default: —	Range: —
`Telemetry`array Telemetry	array	Types of telemetry events that should be logged.	Default: ["Everything"]	Range: —
string	string	—	Default: —	Range: Everything, Execution, Fork, Exit, Close, Rename, Unlink, Link, ExchangeData, Disk, Bundle, Allowlist, FileAccess, CodesigningInvalidated, LoginWindowSession, LoginLogout, ScreenSharing, OpenSSH, Authentication, Clone, Copyfile, GatekeeperOverride, LaunchItem, TCCModification, XProtect, ProcSuspendResume, None
`AllowedPathRegex`string Allowed Path Regex	string	Path regexes (ICU format) of binaries to allow. Lower precedent than binary, certificate, and Team ID scopes.	Default: —	Range: —
`BlockedPathRegex`string Blocked Path Regex	string	Path regexes (ICU format) of binaries to block. Lower precedent than binary, certificate, and Team ID scopes.	Default: —	Range: —
`EnableBadSignatureProtection`boolean Bad Signature Protection	boolean	Block binaries with a bad signing chain, unless explicitly allowed.	Default: false	Range: —
`EnablePageZeroProtection`boolean Enable Page Zero Protection	boolean	Block 32-bit binaries missing the __PAGEZERO segment, unless explicitly allowed.	Default: true	Range: —
`EnableTransitiveRules`boolean Enable Transitive Rules	boolean	Allow transitive rules created by compiler-type rules.	Default: false	Range: —
`StaticRules`array Static Rules	array	A static set of rules that always apply to the host, taking precedence over any rules configured by a sync server. The intended use-case is a small hardcoded set of rules that every host needs, such as management tools — not as a general-purpose rule database. Setting this key (even to an empty array) also prevents local rule management via the santactl rule command.	Default: —	Range: —
`Rule`dict Rule	dict	—	Default: —	Range: —
`identifier`string Identifier required	string	The identifier for this rule. The required format depends on rule_type: • BINARY / CERTIFICATE — SHA-256 hash (64 hex characters) • TEAMID — 10-character alphanumeric Team ID (e.g. ZMCG7MLDV9) • SIGNINGID — TeamID:SigningID (e.g. EQHXZ8M8AV:com.google.Chrome), or platform:SigningID for Apple platform binaries (e.g. platform:com.apple.curl) • CDHASH — Code Directory Hash (40 hex characters)	Default: —	Range: —
`rule_type`string Rule Type required	string	The type of rule. Also determines the required format of the identifier and the rule's evaluation precedence: CDHash → Binary → SigningID → Certificate → TeamID.	Default: —	Range: Binary (SHA-256) (BINARY), Certificate (SHA-256) (CERTIFICATE), Team ID (TEAMID), Signing ID (SIGNINGID), CDHash (CDHASH)
`policy`string Policy required	string	The action to take when this rule matches an execution. ALLOWLIST_COMPILER rules create transitive allow rules for files written by the matched process; if EnableTransitiveRules is false they are treated as ALLOWLIST. CEL rules evaluate the expression in cel_expr to make their decision.	Default: —	Range: Allowlist (ALLOWLIST), Allowlist Compiler (ALLOWLIST_COMPILER), Blocklist (BLOCKLIST), Silent Blocklist (SILENT_BLOCKLIST), CEL (CEL)
`cel_expr`string CEL Expression	string	A CEL (Common Expression Language) expression to evaluate when this rule matches. Required when policy is CEL. The expression receives an ExecutionContext and must return either a ReturnValue or a bool (true = ALLOWLIST, false = BLOCKLIST).	Default: —	Range: —
`custom_msg`string Custom Message	string	Custom message to display in the block notification when this rule blocks an execution. Overrides the global BannedBlockMessage for this specific rule. Only applies to BLOCKLIST and SILENT_BLOCKLIST policies.	Default: —	Range: —
`custom_url`string Custom URL	string	A custom URL for the block notification button, overriding the global EventDetailURL for this specific rule. Supports the same substitution placeholders as EventDetailURL (e.g. %file_identifier%, %machine_id%, %username%). Only applies to BLOCKLIST policies.	Default: —	Range: —
`comment`string Comment	string	A freeform comment or note about this rule for documentation purposes. Ignored by Santa at runtime.	Default: —	Range: —
`EnableSilentMode`boolean Enable Silent Mode	boolean	Disable all GUI notifications.	Default: false	Range: —
`EnableSilentTTYMode`boolean Enable Silent TTY Mode	boolean	Disable all TTY (terminal) notifications.	Default: false	Range: —
`EnableMenuItem`boolean Enable Menu Item	boolean	Show the Santa menu bar item.	Default: true	Range: —
`AboutText`string About Text	string	Custom text to display at launch.	Default: —	Range: —
`MoreInfoURL`string More Info URL	string	Optional "More Info..." link.	Default: —	Range: —
`EventDetailURL`string Event Detail URL	string	The URL to open when the user gets a block notification. If unset, the button will not be displayed. Can include the following variables for substitution: %file_identifier% - SHA-256 of the file that was blocked %bundle_or_file_identifier% - SHA-256 of the file that was blocked or the bundle containing it, if available %file_sha% - Deprecated, acts like bundle_or_file_identifier %machine_id% - ID of the machine %username% - The executing user %serial% - System's serial number %uuid% - System's UUID %hostname% - System's full hostname	Default: —	Range: —
`EventDetailText`string Event Detail Text	string	The text of the button for Event Detail URL.	Default: —	Range: —
`FileAccessEventDetailURL`string File Access Event Detail URL	string	The URL to open when the user gets a file access block notification. If unset, the button will not be displayed. Can include the following variables for substitution: %rule_version% - Version of the rule that was violated %rule_name% - Name of the rule that was violated %accessed_path% - The path accessed by the binary %file_identifier% - SHA-256 of the binary that performed the access %username% - The executing user %team_id% - The Team ID that signed the binary, if any %signing_id% - The Signing ID of the binary, if any %cdhash% - The binary's CDHash, if any %machine_id% - ID of the machine %hostname% - System's full hostname %uuid% - System's UUID %serial% - System's serial number	Default: —	Range: —
`FileAccessEventDetailText`string File Access Event Detail Text	string	The text of the button for File Access Event Detail URL.	Default: —	Range: —
`UnknownBlockMessage`string Unknown Block Message	string	Custom message when an unknown binary is blocked.	Default: —	Range: —
`DismissText`string Dismiss Text	string	The text to display on the button that dismisses the binary block dialog.	Default: "Dismiss"	Range: —
`BannedBlockMessage`string Banned Block Message	string	Custom message when a binary is blocked by a rule.	Default: —	Range: —
`ModeNotificationMonitor`string Monitor Notification Text	string	Custom message when entering MONITOR mode.	Default: "Switching into Monitor mode"	Range: —
`ModeNotificationLockdown`string Lockdown Notification Text	string	Custom message when entering LOCKDOWN mode.	Default: "Switching into Lockdown mode"	Range: —
`ModeNotificationStandalone`string Standalone Notification Text	string	Custom message when entering STANDALONE mode. (undocumented)	Default: "Switching into Standalone mode"	Range: —
`BannedUSBBlockMessage`string Banned USB Block Message	string	Custom message when a Removable Media (e.g. USB device) is prevented from being mounted.	Default: —	Range: —
`RemountUSBBlockMessage`string Remount USB Block Message	string	Custom message when a Removable Media (e.g. USB device) is allowed to be mounted with a subset of the requested flags as defined by RemountUSBMode.	Default: —	Range: —
`FileAccessBlockMessage`string File Access Block Message	string	Custom message when a file access is blocked by a rule.	Default: —	Range: —
`EnableNotificationSilences`boolean Enable Notification Silences	boolean	Allow users to silence notifications.	Default: true	Range: —
`BrandingCompanyName`string Branding Company Name	string	Company name displayed in Santa UI. For GUI windows, this setting is ignored if BrandingCompanyLogo is set.	Default: —	Range: —
`BrandingCompanyLogo`string Branding Company Logo	string	A URL referencing a logo image to display on Santa UIs. The image will be scaled down appropriately to fit within image bounds (currently 84x28 pixels). If set, this overrides BrandingCompanyName. Supported URL schemes: file:// and data:. HTTP/HTTPS URLs are not supported.	Default: —	Range: —
`BrandingCompanyLogoDark`string Branding Company Logo (Dark Mode)	string	A URL referencing a logo image to display on Santa UIs. When the UI is displayed in dark mode and this is set, it overrides both BrandingCompanyLogo and BrandingCompanyName. Supported URL schemes: file:// and data:. HTTP/HTTPS URLs are not supported.	Default: —	Range: —
`FunFontsOnSpecificDays`boolean Fun Fonts On Specific Days	boolean	Enable themed fonts and images on April 1, May 4 and October 31.	Default: false	Range: —
`SyncBaseURL`string Sync Server URL	string	—	Default: —	Range: —
`SyncEnableProtoTransfer`boolean Enable Proto Transfer	boolean	Enable binary proto transfer for sync instead of JSON.	Default: false	Range: —
`SyncProxyConfiguration`dict Sync Proxy Configuration	dict	Proxy configuration applied to all network requests made during syncing. This dictionary is passed directly to NSURLSessionConfiguration.connectionProxyDictionary. Keys are the kCFNetworkProxies* CFNetwork constants (e.g. HTTPEnable, HTTPProxy, HTTPPort, SOCKSEnable, ProxyAutoConfigURLString).	Default: —	Range: —
`SyncEnableCleanSyncEventUpload`boolean Enable Upload Clean Syncs	boolean	Upload events to the sync server even if a clean sync is requested.	Default: false	Range: —
`ClientAuthCertificateFile`string Client Certificate File Path	string	Location of a PKCS#12 certificate to be used for sync authentication.	Default: —	Range: —
`ClientAuthCertificatePassword`string Client Certificate Password	string	—	Default: —	Range: —
`ClientAuthCertificateCN`string Client Certificate Common Name	string	The Common Name of a certificate in the System keychain to be used for sync authentication.	Default: —	Range: —
`ClientAuthCertificateIssuerCN`string Client Certificate Issuer Common Name	string	The Issuer Name of a certificate in the System keychain to be used for sync authentication.	Default: —	Range: —
`ServerAuthRootsData`data Server Authentication Certificate Roots	data	X.509 certificate (.pem) for inclusion on device. A valid PEM containing one or more certificates to be used for certificate pinning.	Default: —	Range: —
`ServerAuthRootsFile`string Server Authentication Certificate Roots (Local)	string	Path to an on-disk X.509 certificate (.pem). A valid PEM containing one or more certificates to be used for certificate pinning.	Default: —	Range: —
`MachineOwner`string Machine Owner	string	—	Default: —	Range: —
`MachineOwnerGroups`array Machine Owner Groups	array	Groups the machine owner is a member of.	Default: —	Range: —
string	string	—	Default: —	Range: —
`MachineID`string Machine ID	string	—	Default: —	Range: —
`MachineOwnerPlist`string Machine Owner Plist	string	The path to a plist that contains the MachineOwnerKey / value pair.	Default: —	Range: —
`MachineOwnerKey`string Machine Owner Key	string	The key to use on Machine Owner Plist.	Default: —	Range: —
`MachineOwnerGroupsKey`string Machine Owner Groups Key	string	The key to use on MachineOwnerPlist to access defined groups.	Default: —	Range: —
`MachineIDPlist`string Machine ID Plist	string	The path to a plist that contains the MachineIDKey / value pair.	Default: —	Range: —
`MachineIDKey`string Machine ID Key	string	The key to use on Machine ID Plist.	Default: —	Range: —
`EnableAllEventUpload`boolean Enable All Event Upload	boolean	Upload all execution events to the sync server, including those explicitly allowed.	Default: false	Range: —
`DisableUnknownEventUpload`boolean Disable Unknown Event Upload	boolean	Do not upload events for executions of unknown binaries allowed in monitor mode.	Default: false	Range: —
`SyncClientContentEncoding`string Sync Client Content Encoding	string	Content encoding used for sync requests.	Default: "deflate"	Range: deflate, gzip, none
`SyncExtraHeaders`dict Sync Extra Headers	dict	Dictionary of additional headers to include in all requests made to the sync server. System-managed headers such as Content-Length, Host, and WWW-Authenticate will be ignored.	Default: —	Range: —
`{{key}}`string Header Key	string	—	Default: —	Range: —
`{{value}}`string Header Value	string	—	Default: —	Range: —
`EventLogType`string Event Log Type	string	Defines how event logs are stored. Allowed values: syslog, file, protobuf, json, null. Note: the protobuf and JSON formats are in BETA and subject to change.	Default: "file"	Range: System Log (syslog), File (file), Protobuf (protobuf), JSON (json), None (null)
`EventLogPath`string Event Log Path	string	Path to the event log file (used for file/json logging).	Default: "/var/db/santa/santa.log"	Range: —
`SpoolDirectory`string Spool Directory	string	Base directory for protobuf maildir-like logs.	Default: "/var/db/santa/spool"	Range: —
`SpoolDirectoryFileSizeThresholdKB`integer Spool Max File Size	integer	Per-file size limit (KB) for protobuf spool files.	Default: 250	Range: —
`SpoolDirectorySizeThresholdMB`integer Spool Max Size	integer	Total size limit (MB) for protobuf spool directory.	Default: 100	Range: —
`SpoolDirectoryEventMaxFlushTimeSec`integer Spool Max Event Buffer	integer	Maximum time (seconds) events are buffered before flushing to disk.	Default: 15	Range: —
`EnableMachineIDDecoration`boolean Enable Machine ID Decoration	boolean	Appends the MachineID to the end of each log line if enabled.	Default: false	Range: —
`EntitlementsPrefixFilter`array Entitlements Prefix Filter	array	Filters entitlements from execution telemetry by prefix. Entitlements are only logged when EventLogType is set to protobuf or json.	Default: —	Range: —
string	string	—	Default: —	Range: —
`EntitlementsTeamIDFilter`array Entitlements Team ID Filter	array	Filters entitlements from execution telemetry by Team ID. Entitlements are only logged when EventLogType is set to protobuf or json.	Default: —	Range: —
string	string	—	Default: —	Range: —
`TelemetryFilterExpressions`array Telemetry Filter Expressions	array	CEL expressions for filtering or redacting telemetry before upload. Only useful for Workshop customers.	Default: —	Range: —
string	string	—	Default: —	Range: —
`MetricFormat`string Metric Format	string	Format to export metrics as, supported formats are "rawjson" for a single JSON blob and "monarchjson" for a format consumable by Google's Monarch tooling.	Default: —	Range: Raw JSON (rawjson), Monarch JSON (monarchjson)
`MetricURL`string Metric URL	string	URL describing where monitoring metrics should be exported.	Default: —	Range: —
`MetricExportInterval`integer Metric Export Interval	integer	Time (seconds) between exporting metrics.	Default: 30	Range: —
`MetricExportTimeout`integer Metric Export Timeout	integer	Timeout (seconds) for exporting metrics.	Default: 30	Range: —
`MetricExtraLabels`dict Metric Extra Labels	dict	A map of key value pairs to add to all metric root labels. If a previously set key (e.g. host_name) is set to "" then the key is removed from the metric root labels. Alternatively if a value is set for an existing key then the new value will override the old.	Default: —	Range: —
`{{key}}`string	string	—	Default: —	Range: —
`{{value}}`string	string	—	Default: —	Range: —
`EnableStandalonePasswordFallback`boolean Enable Standalone Password Fallback	boolean	Enable password authorization fallback for Standalone mode.	Default: true	Range: —
`IgnoreOtherEndpointSecurityClients`boolean Ignore Other Endpoint Security Clients	boolean	Ignore events generated by other EndpointSecurity clients.	Default: false	Range: —
`EnableStatsCollection`boolean Enable Stats Collection	boolean	Send basic stats to North Pole Security	Default: false	Range: —
`StatsOrganizationID`string Stats Organization ID	string	North Pole Security customer ID for stats collection.	Default: —	Range: —
`AntiSuspendSigningIDs`array Anti Suspend Signing IDs	array	A list of Signing IDs to protect from `pid_suspend` calls.	Default: —	Range: —
string	string	—	Default: —	Range: —
`AllowedSantaCommands`array Allowed Santa Commands	array	Array of allowed Santa commands. If unset, all commands are allowed; if set to an empty array, no commands are allowed.	Default: —	Range: —
string	string	—	Default: —	Range: kill, ping, eventupload
`AllowDelegatedSignals`boolean Allow Delegated Signals	boolean	Allow signals delegated by launchd on behalf of Apple platform binaries targeting santad.	Default: false	Range: —
`FileAccessPolicyPlist`string File Access Policy Plist	string	Path to a file access configuration plist.	Default: —	Range: —
`FileAccessPolicy`dict File Access Policy	dict	A complete file access policy embedded directly in the Santa configuration. When set, FileAccessPolicyPlist is ignored.	Default: —	Range: —
`FileAccessPolicyUpdateIntervalSec`integer File Access Policy Update Interval	integer	How often (in seconds) to re-read the file access policy config.	Default: 600	Range: 15 – —
`OverrideFileAccessAction`string Override File Access Action	string	Global override for the enforcement of all file access policy rules.	Default: "none"	Range: Audit Only (AUDIT_ONLY), Disable (DISABLE), None (none)
`FileAccessGlobalLogsPerSec`integer File Access Global Logs Per Second	integer	Average number of file access logs per second. Set to 0 to disable rate limiting.	Default: 60	Range: 0 – —
`FileAccessGlobalWindowSizeSec`integer File Access Global Window Size	integer	Window size over which the log rate limit is applied. Set to 0 to disable rate limiting.	Default: 15	Range: 0 – —
`RemovableMediaAction`string Removable Media Action	string	Action applied to all removable media devices.	Default: —	Range: Allow (Allow), Block (Block), Remount with Restrictions (Remount)
`RemovableMediaRemountFlags`array Removable Media Remount Flags	array	Mount flags applied when removable media is remounted.	Default: —	Range: —
string	string	—	Default: —	Range: rdonly, noexec, nosuid, nobrowse, noowners, nodev, async, -j
`EncryptedRemovableMediaAction`string Encrypted Removable Media Action	string	Action applied to encrypted removable media devices.	Default: —	Range: Allow (Allow), Block (Block), Remount with Restrictions (Remount)
`EncryptedRemovableMediaRemountFlags`array Encrypted Removable Media Remount Flags	array	Mount flags applied when encrypted removable media is remounted.	Default: —	Range: —
string	string	—	Default: —	Range: rdonly, noexec, nosuid, nobrowse, noowners, nodev, async, -j
`OnStartUSBOptions`string On Start USB Options	string	Action applied to existing removable media when Santa starts.	Default: —	Range: Unmount (Unmount), Force Unmount (ForceUnmount), Remount (Remount), Force Remount (ForceRemount)