Santa

The app provides the sync server for Santa. Macs download their configuration and rules, then upload execution and file-access events.

Configurations

A configuration contains Santa client settings and targets one or more labels. Configurations are ordered, and a label can belong to only one configuration.

Settings include client mode, sync timing, event upload, bundle handling, path regular expressions, and removable-media policy.

Rules

Rules allow or block binaries, certificates, team IDs, signing IDs, code-directory hashes, or bundles. Each rule includes one label and can exclude other labels.

The rule form can search observed execution events for known targets. A host page shows the rules that apply to that Mac.

Events

Execution events and file-access events reported by Santa appear on read-only event pages.

WOODSTAR_SANTA_EVENT_RETENTION_DAYS controls retention. See Environment.

See Santa Sync for client configuration.