Santa (Google)

com.google.santa

Santa settings

macOS

Configuration Keys (42)

Key	Type	Title	Description	Default	Range
`PFC_SegmentedControl_0`required	string	—	—	—	—
`ClientMode`	integer	Client Mode	—	1
`FailClosed`	boolean	Deny on Read Error	Deny execution in LOCKDOWN mode if there is an error reading or processing an executable file.	false	—
`FileChangesRegex`	string	File Changes Regex	Path regexes (ICU format) to monitor for file changes.	—	—
`AllowedPathRegex`	string	Allowed Path Regex	Path regexes (ICU format) of binaries to allow. Lower precedent than binary, certificate, and Team ID scopes.	—	—
`BlockedPathRegex`	string	Blocked Path Regex	Path regexes (ICU format) of binaries to block. Lower precedent than binary, certificate, and Team ID scopes.	—	—
`EnableBadSignatureProtection`	boolean	Bad Signature Protection	Block binaries with a bad signing chain, unless explicitly allowed.	false	—
`EnablePageZeroProtection`	boolean	Enable Page Zero Protection	Block 32-bit binaries missing the __PAGEZERO segment, unless explicitly allowed.	true	—
`EnableSysxCache`	boolean	Enable Sysx Cache	Enable secondary cache. Improves performance when multiple EndpointSecurity system extensions are installed.	true	—
`AboutText`	string	About Text	Custom text to display at launch.	—	—
`MoreInfoURL`	string	More Info URL	Optional "More Info..." link.	—	—
`EventDetailURL`	string	Event Detail URL	The URL to open when the user gets a block notification. If unset, the button will not be displayed. Can include the following variables for substitution: %file_identifier% - SHA-256 of the file that was blocked %bundle_or_file_identifier% - SHA-256 of the file that was blocked or the bundle containing it, if available %file_sha% - Deprecated, acts like bundle_or_file_identifier %machine_id% - ID of the machine %username% - The executing user %serial% - System's serial number %uuid% - System's UUID %hostname% - System's full hostname	—	—
`EventDetailText`	string	Event Detail Text	The text of the button for Event Detail URL.	—	—
`UnknownBlockMessage`	string	Unknown Block Message	Custom message when an unknown binary is blocked.	—	—
`BannedBlockMessage`	string	Banned Block Message	Custom message when a binary is blocked by a rule.	—	—
`ModeNotificationMonitor`	string	Monitor Notification Text	Custom message when entering MONITOR mode.	—	—
`ModeNotificationLockdown`	string	Lockdown Notification Text	Custom message when entering LOCKDOWN mode.	—	—
`SyncBaseURL`	string	Sync Server URL	—	—	—
`SyncEnableCleanSyncEventUpload`	boolean	Enable Upload Clean Syncs	Upload events to the sync server even if a clean sync is requested.	false	—
`ClientAuthCertificateFile`	string	Client Certificate File Path	Location of a PKCS#12 certificate to be used for sync authentication.	—	—
`ClientAuthCertificatePassword`	string	Client Certificate Password	—	—	—
`ClientAuthCertificateCN`	string	Client Certificate Common Name	The Common Name of a certificate in the System keychain to be used for sync authentication.	—	—
`ClientAuthCertificateIssuerCN`	string	Client Certificate Issuer Common Name	The Issuer Name of a certificate in the System keychain to be used for sync authentication.	—	—
`ServerAuthRootsData`	data	Server Authentication Certificate Roots	X.509 certificate (.pem) for inclusion on device. A valid PEM containing one or more certificates to be used for certificate pinning.	—	—
`ServerAuthRootsFile`	string	Server Authentication Certificate Roots (Local)	Path to an on-disk X.509 certificate (.pem). A valid PEM containing one or more certificates to be used for certificate pinning.	—	—
`MachineOwner`	string	Machine Owner	—	—	—
`MachineID`	string	Machine ID	—	—	—
`MachineOwnerPlist`	string	Machine Owner Plist	The path to a plist that contains the MachineOwnerKey / value pair.	—	—
`MachineOwnerKey`	string	Machine Owner Key	The key to use on Machine Owner Plist.	—	—
`MachineIDPlist`	string	Machine ID Plist	The path to a plist that contains the MachineOwnerKey / value pair.	—	—
`MachineIDKey`	string	Machine ID Key	The key to use on Machine ID Plist.	—	—
`EventLogType`	string	Event Log Type	syslog: Sent to ASL or ULS (if built with the 10.12 SDK or later); filelog: Sent to a file on disk. Use EventLogPath to specify a path.	"filelog"
`EventLogPath`	string	Event Log Path	— Depends on: EventLogType ∈ [filelog]	"/var/db/santa/santa.log"	—
`MailDirectory`	string	Mail Directory	The base directory used to save mail files. Depends on: EventLogType ∈ [protobuf]	"/var/db/santa/mail"	—
`MailDirectoryFileSizeThresholdKB`	integer	Mail Max File Size	Per-file size limit (KB) for files stored in the event log mail directory.	100	—
`MailDirectorySizeThresholdMB`	integer	Mail Max Size	Total file size limit (MB) for all files stored in the event log mail directory.	500	—
`MailDirectoryEventMaxFlushTimeSec`	integer	Mail Max Event Buffer	Maximum time (seconds) events will stay buffered in memory before being flushed to disk.	5	—
`EnableMachineIDDecoration`	boolean	Enable Machine ID Decoration	Appends the MachineID to the end of each log line if enabled.	false	—
`MetricFormat`	string	Metric Format	The key to use on Machine ID Plist.	""
`MetricURL`	string	Metric URL	URL describing where monitoring metrics should be exported.	—	—
`MetricExportInterval`	integer	Metric Export Interval	Time (seconds) between exporting metrics.	30	—
`MetricExportTimeout`	integer	Metric Export Timeout	Timeout (seconds) for exporting metrics.	30	—