Your Friendly Neighborhood GitOps Enabled, Battle-Tested Santa Sync Server.

Zentral is the reliable way to manage Google’s leading edge open source application control system for macOS.

Zentral enables automatic rule management.

Use Zentral to sync ALLOW or BLOCK rules targeting applications with the Santa Agent automatically. Rules can be scoped to machines with inventory tags, serial numbers and principal users. To identify the application targeted by a rule, you can use either:

  • The Team ID of the signature
  • A signature certificate hash
  • The binary hash
  • The bundle hash
learn more about the Google Santa rules

From monitor to lockdown mode.

When implementing Santa you begin in Monitor mode (where unknown applications are allowed). See all applications that run on your fleet, then start with creating rules to BLOCK or ALLOW them.

Once you are confident that you are not impacting your users, you can progress to Lockdown mode (block unknown apps by default). Start with testing on a few devices and then expand if successful. You can always switch back to Monitor mode if you are having an issue.

learn more about the Google Santa modes
GitOps workflows for Santa rules.

GitOps workflows for Santa rules.

Use the official Zentral Terraform module to manage Santa configurations, enrollments, and rules. This is perfect for a CI/CD system. Protect your main branch, setup mandatory code reviews and dry-runs for the pull requests to improve the security and reliability of your configuration. Zentral will generate audit events for each configuration change.

Lower level API endpoints and a Jenkins pipeline integration example are also available if you want to build a custom workflow.

Onboard USB storage control.

Apple deprecated the MDM mount controls for the removable storage devices with macOS 11.

To close that gap, the team at Google have integrated a mechanism that uses the macOS endpoint security framework to block removable storage devices or force them to be mounted with special flags (e.g. read-only or no-exec). You can manage this mechanism with Zentral because it is part of the Santa sync protocol. Different configurations can be used for different groups of machines to match your requirements.

Our Enterprise Plan helps you succeed with:

Santa agent deployment.

We manage the Santa agent with macOS configuration, Zentral enrollment and upgrades.

Santa configuration.

We configure Santa based on your requirements and guide you toward Lockdown mode for at least a subset of devices.

Rules CI/CD workflow.

Implement CI/CD worfklow setup for the rulesets, using your existing Gitlab or GitHub system.

Want to Find Out Who's Naughty or Nice?

Learn about our test environment programm (it's free!)