Santa (North Pole Security)

—

—

Deny execution in LOCKDOWN mode if there is an error reading or processing an executable file.

Path regexes (ICU format) to monitor for file changes.

Path regexes (ICU format) of binaries to allow. Lower precedent than binary, certificate, and Team ID scopes.

Path regexes (ICU format) of binaries to block. Lower precedent than binary, certificate, and Team ID scopes.

Block binaries with a bad signing chain, unless explicitly allowed.

Block 32-bit binaries missing the __PAGEZERO segment, unless explicitly allowed.

Enable secondary cache. Improves performance when multiple EndpointSecurity system extensions are installed.

Custom text to display at launch.

Optional "More Info..." link.

The URL to open when the user gets a block notification. If unset, the button will not be displayed. Can include the following variables for substitution: %file_identifier% - SHA-256 of the file that was blocked %bundle_or_file_identifier% - SHA-256 of the file that was blocked or the bundle containing it, if available %file_sha% - Deprecated, acts like bundle_or_file_identifier %machine_id% - ID of the machine %username% - The executing user %serial% - System's serial number %uuid% - System's UUID %hostname% - System's full hostname

The text of the button for Event Detail URL.

Custom message when an unknown binary is blocked.

Custom message when a binary is blocked by a rule.

Custom message when entering MONITOR mode.

Custom message when entering LOCKDOWN mode.

—

Upload events to the sync server even if a clean sync is requested.

Location of a PKCS#12 certificate to be used for sync authentication.

—

The Common Name of a certificate in the System keychain to be used for sync authentication.

The Issuer Name of a certificate in the System keychain to be used for sync authentication.

X.509 certificate (.pem) for inclusion on device. A valid PEM containing one or more certificates to be used for certificate pinning.

Path to an on-disk X.509 certificate (.pem). A valid PEM containing one or more certificates to be used for certificate pinning.

—

—

The path to a plist that contains the MachineOwnerKey / value pair.

The key to use on Machine Owner Plist.

The path to a plist that contains the MachineOwnerKey / value pair.

The key to use on Machine ID Plist.

syslog: Sent to ASL or ULS (if built with the 10.12 SDK or later); filelog: Sent to a file on disk. Use EventLogPath to specify a path.

—

Depends on: EventLogType ∈ [filelog]

The base directory used to save mail files.

Depends on: EventLogType ∈ [protobuf]

Per-file size limit (KB) for files stored in the event log mail directory.

Total file size limit (MB) for all files stored in the event log mail directory.

Maximum time (seconds) events will stay buffered in memory before being flushed to disk.

Appends the MachineID to the end of each log line if enabled.

The key to use on Machine ID Plist.

URL describing where monitoring metrics should be exported.

Time (seconds) between exporting metrics.

Timeout (seconds) for exporting metrics.