Skip to main content

Config Generator

warning

This generator is still under active development and there are known rough edges with some of the more complex configuration keys as well as more features that will be coming soon. Please give it a try!

Use this form to generate a valid Santa configuration, ready to put inside a configuration profile and deploy to your machines. The generator will ensure that the configuration is valid and help storing default values.

info

The generation is all done inside your browser; the data you input never leaves your machine.

General​

The client mode that Santa should operate in.

If true and the ClientMode is Lockdown or Standalone: execution will be denied when there is an error reading or processing an executable file and when Santa has to make a default response just prior to deadlines expiring.

For an executable that Santa cannot read, this key applies only when ExecutableIntegrityPolicy is Report or Ignore. Under the default, Enforce, Santa denies that execution in Lockdown and Standalone modes whatever the value of this key.

What Santa does when it cannot confirm that the file it evaluated is the image the kernel loaded: the file changed during launch, or Santa could not read it. If the file on disk still has the signing identity the kernel reported, Santa evaluates it normally and this key does not apply.

The default depends on the client mode. In Monitor mode, Enforce behaves as Report, so Santa does not deny an execution in Monitor mode because its file changed or could not be read, except for the SEATBELT case below. Temporary Monitor Mode counts as Monitor mode.

Client modeUnset or EnforceReportIgnore
MonitorReportReportIgnore
LockdownEnforceReportIgnore
StandaloneEnforceReportIgnore

Warning: in Lockdown and Standalone modes, Enforce denies every binary that Santa cannot read. This includes short-lived build outputs and binaries on unreliable network or removable volumes. If this affects your fleet, use Report.

Under Report and Ignore, Santa evaluates rules against the file on disk, which may not be the file that ran. If Santa cannot read the file, the FailClosed key decides what happens. The two values differ only in event storage. Report always stores the event for the sync server. Ignore stores the event under Santa's normal upload settings, so events can still be stored.

A binary a SEATBELT rule would sandbox is denied outright whenever its identity could not be confirmed, under every value of this key and in every client mode.

If true, Santa will fallback to password authorization for Standalone mode.

If true, Santa will not process events that are generated by other EndpointSecurity clients that may be installed on the system

A list of Signing IDs to protect from pid_suspend calls.

Array of allowed Santa Commands. If the key AllowedSantaCommands is unset (nil), all commands are allowed. If AllowedSantaCommands is an empty array, none of the commands are allowed.

Select...

If true, signals delegated by 'launchd' on behalf of any Apple platform binary targeting 'santad' are allowed.

Sync​

The base URL of the sync server. HTTPS is required unless the host is localhost (localhost, 127.0.0.1, or ::1).

If true, sync will happen using binary protos instead of JSON

The proxy configuration to use when syncing. See the Apple Documentation for details on the keys that can be used in this dictionary

This key is not yet supported by the generator

If true, events will be uploaded to the sync server even if a clean sync is requested

If set, this contains the location of a PKCS#12 certificate to be used for sync authentication

Contains the password for the PKCS#12 certificate

If set, this is the Common Name of a certificate in the System keychain to be used for sync authentication. The corresponding private key must also be in the keychain. Matching is case sensitive. If several certificates match, the one with the latest valid-from date is chosen. In Santa 2026.9 and later, if Santa cannot use that certificate's private key, it tries the next match. Ignored if ClientAuthCertificateFile is set

If set, this is the Issuer Name of a certificate in the System keychain to be used for sync authentication. The corresponding private key must also be in the keychain. Matching is case sensitive. If several certificates match, the one with the latest valid-from date is chosen. In Santa 2026.9 and later, if Santa cannot use that certificate's private key, it tries the next match. Ignored if ClientAuthCertificateFile or ClientAuthCertificateCN is set

If set, this is valid PEM containing one or more certificates to be used for certificate pinning. To comply with ATS the certificate chain must also be trusted in the keychain. This should not be used by Workshop customers as it will be ignored.

This key is not yet supported by the generator

The same as the above but is a path to a file on disk containing the PEM data. This should not be used by Workshop customers as it will be ignored.

The machine owner

Groups the machine owner is a member of

The machine ID. Care should be taken if overriding the default value. Using it incorrectly with a sync server that implements progressive syncing could lead to incomplete rules.

The path to a plist that contains the MachineOwnerKey / value pair

The key to use on MachineOwnerPlist

The key to use on MachineOwnerPlist to access defined groups

The path to a plist that contains the MachineOwnerKey / value pair

The key to use on MachineIDPlist

If true, the client will upload all execution events to the sync server, including those that were explicitly allowed

If true, the client will not upload events for executions of unknown binaries allowed in monitor mode

Sets the Content-Encoding header for requests sent to the sync service

Dictionary of additional headers to include in all requests made to the sync server. System managed headers such as Content-Length, Host, WWW-Authenticate etc will be ignored

This key is not yet supported by the generator

GUI​

If true, Santa will not post any GUI notifications. This can be a very confusing experience for users, use with caution

If true, Santa will not post any TTY notifications. This can be a very confusing experience for users, use with caution

If true, Santa will show an item in the macOS menu bar to allow syncing and management of temporary monitor mode by default. Users are able to show/hide the menu item from the About window.

The text to display when the user opens Santa.app. If unset, the default text will be displayed

The URL to open when the user clicks “More Info…” when opening Santa.app. If unset, the button will not be displayed

When the user gets a block notification, a button can be displayed which will take them to a web page with more information about that event. This URL will be used for all rules unless overridden by a rule-specific option.

This property supports several placeholders in the string that will be replaced before the URL is constructefd to be turned into the URL to send them to. The following sequences will be replaced in the final URL:

PlaceholderDescription
%file_identifier%SHA-256 of the file that was blocked
%bundle_or_file_identifier%SHA-256 of the file that was blocked or the bundle containing it, if available
%file_bundle_id%The bundle ID that this binary is part of, if any
%team_id%The team ID that signed this binary, if any
%signing_id%The signing ID of this binary, if any
%cdhash%The binary's CDHash, if any
%machine_id%ID of the machine
%username%The executing user
%serial%System's serial number
%uuid%System's UUID
%hostname%System's full hostname

Example: https://sync-server-hostname/%machine_id%/%file_identifier%

Related to the above property, this string represents the text to show on the button

When the user gets a file access block notification, a button can be displayed which will take them to a web page with more information about that event. This URL will be used for all file access rules unless overridden by a rule-specific option.

This property supports several placeholders in the string that will be replaced before the URL is constructed. The following sequences will be replaced in the final URL:

PlaceholderDescription
%rule_version%Version of the rule that was violated
%rule_name%Name of the rule that was violated
%accessed_path%The path accessed by the binary
%file_identifier%SHA-256 of the binary that performed the access
%username%The executing user
%team_id%The Team ID that signed the binary, if any
%signing_id%The Signing ID of the binary, if any
%cdhash%The binary's CDHash, if any
%machine_id%ID of the machine
%hostname%System's full hostname
%uuid%System's UUID
%serial%System's serial number

Example: https://sync-server-hostname/%machine_id%/%rule_name%/%rule_version%

Related to the FileAccessEventDetailURL key, this string represents the text to show on the button for file access events

The text to display on the button that dismisses the binary block dialog. The default text is "Dismiss"

In Lockdown/Standalone mode this is the message shown to the user when an unknown binary is blocked. If this message is not configured a reasonable default is provided

This is the message shown to the user when a binary is blocked because of a rule if that rule doesn't provide a custom message. If this is not configured a reasonable default is provided

The notification text to display when the client goes into Monitor mode.

The notification text to display when the client goes into Lockdown mode.

Message to display when a Removable Media (e.g. USB device) is prevented from being mounted. Workshop can set this for hosts running Santa 2026.9 or later.

Message to display when a Removable Media (e.g. USB device) is allowed to be mounted with a subset of the requested flags as defined by RemovableMediaRemountFlags or EncryptedRemovableMediaRemountFlags. Workshop can set this for hosts running Santa 2026.9 or later.

This is the message shown to the user when a access to a file is blocked because of a rule defined by FileAccessPolicy if that rule doesn't provide a custom message. If this is not configured a reasonable default is provided

If false, the user will not be presented with an option to silence notifications

The company name to display on Santa GUIs as well as in messages written to the TTY. For GUI windows, this setting is ignored if BrandingCompanyLogo is set.

See Custom Branding for examples of how this appears to users.

A URL referencing a logo image to display on Santa UIs. The image will be scaled down appropriately to fit within image bounds (currently 84x28 points). If set, this overrides BrandingCompanyName.

Supported URL schemes:

  • file:// - Local file path (e.g., file:///Library/Application%20Support/MyOrg/logo.png)
  • data: - Base64-encoded image data (e.g., data:image/png;base64,iVBORw0KG...)

Note: HTTP/HTTPS URLs are not supported.

See Custom Branding for examples of how this appears to users.

A URL referencing a logo image to display on Santa UIs. When the UI is displayed in dark mode and this is set, it overrides both BrandingCompanyLogo and BrandingCompanyName. The image will be scaled down appropriately to fit within image bounds (currently 84x28 points).

Supported URL schemes:

  • file:// - Local file path (e.g., file:///Library/Application%20Support/MyOrg/logo-dark.png)
  • data: - Base64-encoded image data (e.g., data:image/png;base64,iVBORw0KG...)

Note: HTTP/HTTPS URLs are not supported.

See Custom Branding for examples of how this appears to users.

If true, the Santa UI will use special images/fonts on certain holidays.

FAA​

Path to a file access configuration plist. This is ignored if FileAccessPolicy is also set. See File Access Authorization for configuration details.

A complete file access configuration policy embedded in the main Santa config. If set, FileAccessPolicyPlist will be ignored. See File Access Authorization for configuration details.

This key is not yet supported by the generator

Number of seconds between re-reading the file access policy config and policies/monitored paths updated. The minimum value is 15 seconds.

Defines a global override policy that applies to the enforcement of all FileAccessPolicy rules.

Sets the average logs per second that will be emitted by File Access Authorization rule violations. Setting to 0 will disable log rate limiting. Rate limiting only applies to logging. FAA rules that are not audit only will still block operations that violate the rule.

Sets the window size over which the FileAccessGlobalLogsPerSec setting is applied in order to allow for burts of logs. Setting to 0 will disable log rate limiting. Rate limiting only applies to logging. FAA rules that are not audit only will still block operations that violate the rule.

Rules​

A regex to allow if the binary, certificate, or Team ID scopes did not allow/block execution. Regexes are specified in ICU format.

A regex to block if the binary, certificate, or Team ID scopes did not allow/block an execution. Regexes are specified in ICU format.

If true, binaries with a bad signing chain will be blocked even in MONITOR mode, unless the binary is allowed by an explicit rule.

If true, 32-bit binaries that are missing the __PAGEZERO segment will be blocked even in MONITOR mode, unless the binary is allowed by an explicit rule. This only applies to 32-bit executions, which are the only ones the kernel exempts from its own __PAGEZERO enforcement; for any other image the kernel requires a valid __PAGEZERO at load time, so the setting has no effect.

If true, Santa will respect compiler rules and create allow rules for the executables they produce.

The maximum time, in milliseconds, that Santa holds the execution of a binary that a compiler may have just written, waiting for its transitive rule to be created. The hold applies only when EnableTransitiveRules is true, a compiler ran recently, the binary was created in the last minute, and the binary would otherwise be blocked because no rule matched it. The execution continues as soon as a transitive rule for its exact contents is created, and is killed if no rule allows it in time. Set to 0 to disable the hold. Values above 10000 are reduced to 10000.

A static set of rules to always apply to the host. These rules always take precedence over any configured by a sync server. Having this key set will also prevent local configuration of rules using the santactl rule command.

Within the set of rules configured as StaticRules, the normal rule precedence order applies.

The intended use-case for StaticRules is for a small hardcoded set of rules that every host at a company will need to run even in emergencies, such as management tools. Santa heavily caches these rules and we've seen hosts with a few thousand static rules working correctly, but we don't recommend using StaticRules for this.

This key is not yet supported by the generator

Telemetry​

The regex of paths to log file changes. Regexes are specified in ICU format

Array of path prefix strings. Target paths (e.g. the file being written/removed/etc) that match a prefix are ignored. Events with multiple targets (e.g. rename) are logged if any target is not prefix filtered and matches FileChangesRegex

Array of strings for events that should be logged. NetworkActivity (connections) and DNSActivity (DNS questions) need the network extension.

Everything

Defines how event logs are stored.

Note: The protobuf and JSON formats are in BETA and subject to change. We will call out any changes in the release notes of any future release that changes them.

If EventLogType is set to file or json, EventLogPath will provide the path to save logs. If you change this value ensure you also update com.northpolesec.santa.newsyslog.conf with the new path

If EventLogType is set to protobuf, SpoolDirectory will provide the base directory used to save files according to a maildir-like format

If EventLogType is set to protobuf, SpoolDirectoryFileSizeThresholdKB defines the per-file size limit for files stored in the spool directory. Events are buffered in memory until this threshold would be exceeded (or SpoolDirectoryEventMaxFlushTimeSec is exceeded)

If EventLogType is set to protobuf, SpoolDirectorySizeThresholdMB defines the total combined size limit of all files in the spool directory. Once the threshold is met, the oldest files are deleted to make room for new events

If EventLogType is set to protobuf, SpoolDirectoryEventMaxFlushTimeSec defines the maximum amount of time events will stay buffered in memory before being flushed to disk, regardless of whether or not SpoolDirectoryFileSizeThresholdKB would be exceeded

If this key is true, the MachineID will be added to each log entry.

Filters entitlements from execution telemetry based on prefix (for example: com.apple.private). Entitlements matching a prefix in this list will be omitted from the logged event. This does not prevent the execution event itself from being logged - it only controls which entitlements are included in the event. Entitlements are only logged when EventLogType is set to protobuf or json.

Filters entitlements from execution telemetry based on the process's TeamID. When a process's code signature has a TeamID matching an entry in this list, its entitlements will be omitted from the logged event. This does not prevent the execution event itself from being logged - it only controls which entitlements are included in the event. Entitlements are only logged when EventLogType is set to protobuf or json. Use the value platform to filter entitlements from platform binaries.

A list of CEL expressions for filtering/redacting rows before upload. Only useful for Workshop customers.

A list of CEL expressions evaluated on the host before a binary upload. An expression that matches drops the upload, so the file is not sent. Each expression is evaluated against the binary's metadata. Only useful for Workshop customers.

Removable Media (e.g. USB mass storage device)​

Action for all removable media. If unset, falls back to deprecated BlockUSBMount + RemountUSBMode.

Array of mount flag arguments when RemovableMediaAction is Remount. If unset, falls back to deprecated RemountUSBMode.

Action for encrypted removable media. If unset, encrypted volumes use the baseline policy.

Array of mount flag arguments for encrypted removable media when EncryptedRemovableMediaAction is Remount.

If set, defines the action that should be taken on existing Removable Media (e.g. USB device) mounts when Santa starts up.

Note: “remounts” are implemented by first unmounting and then mounting the device again). Existing mounts with mount flags that are a superset of RemovableMediaRemountFlags or EncryptedRemovableMediaRemountFlags are unaffected and left as-is.

Metrics​

Format to export metrics as.

URL describing where monitoring metrics should be exported

Number of seconds to wait between exporting metrics

Number of seconds to wait before a timeout occurs when exporting metrics

A map of key value pairs to add to all metric root labels. If a previously set key (e.g. host_name is set to "" then the key is removed from the metric root labels. Alternatively if a value is set for an existing key then the new value will override the old.

This key is not yet supported by the generator

Generate​

Click the button to generate and download the generated configuration file.