Santa, North Pole Security’s binary authorization tool for macOS, decides which apps can run on a Mac. It does it with rules: allow this app, block that one.
Santa can run without a server. The rules can be written in a configuration profile, with the StaticRules key, and pushed with MDM. The blocks are written in a log file on the Mac. For a few rules that rarely change, this works.
You need a sync server when you plan to switch to Lockdown mode, or when one user or one Mac needs an exception. A sync server does much more than hand out rules. It adds five things: the events from every Mac, a quick answer to a block, a sync that sends only what changed and confirms what arrived, a configuration that can change at every sync, and the state of every Mac in one place. The first two get you to Lockdown mode and keep you there. Zentral includes a Santa sync server, and the examples below come from it.
Static rules and a sync server, side by side
| Static rules in a profile | A sync server | |
|---|---|---|
| Events | Lines in a log file on each Mac, until the log is rotated | Sent to the server, with the app bundle, the user and the download website |
| An exception | A change to the profile, and a profile of its own for one Mac | A rule for a serial number, a primary user or a tag |
| A rule change | The full list, sent again to every Mac in scope | Only the rules that changed for this Mac |
| Proof it arrived | MDM says the profile was installed | Santa reports its rule counts and a hash of its rules |
| Mode and paths | A new profile to build and push | Sent at every sync |
How a Santa sync works
The Mac finds its sync server with the SyncBaseURL key. Every few minutes, Santa contacts it, in four stages:
preflight: it says who it is, which mode it runs in, and how many rules it has,eventupload: it sends the events it has collected,ruledownload: it downloads the new rules,postflight: it confirms what it received.
The server answers with the rules, and with part of the configuration. Everything below comes from this exchange.
The events: what Santa sends to its sync server
Santa sends its events to the server. A block is sent as soon as it happens. In Monitor mode, Santa also sends the apps it does not know: the ones it would block in Lockdown mode.
Each event has what you need to write a good rule:
- the hash of the file, its signing certificates, its Team ID, signing ID and CDHash,
- the app bundle, with its name and its version,
- the user, the parent process, and the website the file was downloaded from.
An event stays on the Mac until the server has accepted it. Without a server, the events are lines in a log file on each Mac. They have less detail: no app bundle, for example. They stay there until the log is rotated, and another tool has to read them on every Mac.
The events are also how you move to Lockdown mode, which is where application allowlisting starts. You start in Monitor mode, you look at what would have been blocked, you write the rules, and only then do you switch. Without the events, you are guessing.
From a block to an exception, in minutes
When Santa blocks an app, the user sees a dialog. With a sync server, a button in this dialog opens a page about this exact block. This is where an exception starts.
A vote among colleagues. In Zentral, this button can open the voting portal. The user asks for an exception, and colleagues vote. At a first score, the app is allowed for the users who asked for it. At a higher score, it is allowed for everyone. Some groups can have more weight, or can mark an app as malware.
A first review by an AI agent. The server has the whole event, so an agent can do the first review: check the signature and the Team ID, see where the file came from, look up the hash. It can then propose a rule, or add a narrow one for a single Mac with the API or the Terraform provider. The agent does the work, and you keep the decision.
Either way, the new rule reaches the Mac at its next sync, a few minutes later. Without a server, every exception is a change to a profile, and an exception for one Mac needs a profile of its own. There is no shortcut on the Mac either: as soon as it has a static rule, santactl rule cannot add rules on it anymore.
A sync that sends only what changed, and confirms it
Only what changed, only where it is needed. A rule can target a serial number, a primary user or a tag. The sync only sends the rules that changed for this Mac. With a profile, every change sends the full list of rules again, to every Mac in scope. And this list only gets longer.
Santa asks for its rules. It does not wait for an MDM command to reach the Mac. It contacts the server on its own, at a fixed interval (10 minutes by default in Zentral), and gets what changed since its last sync. An admin can also run sudo santactl sync to get a new rule right away.
A sync you can check. In postflight, Santa says how many rules it received and processed, and sends a hash of its rules. The server knows which rule is on which Mac. When something does not match, the next sync sends what is missing, and the server can also ask Santa to rebuild all its rules with a clean sync. With a profile, MDM tells you the profile was installed. It does not tell you that Santa accepted every rule: a rule with a typo is skipped, and you only see it on the Mac.
A Santa configuration that can change at every sync
In its answer to preflight, the server also sends part of the configuration: Monitor or Lockdown mode, the allowed and blocked paths, USB blocking, the button of the block dialog, the sync interval, and more. There is no new profile to build and push.
In Zentral, the mode and the paths can be set for a serial number, a user or a tag. Put one Mac in Monitor mode for a day to fix a problem, then put it back in Lockdown.
The Santa state of every Mac, in one place
Each sync reports the mode, the Santa version and the rule counts. The server shows the Macs that stopped syncing, the ones in the wrong mode, and the ones whose rules do not match. In Zentral, this is the Machines page.
Should you still use static rules?
Yes, as a safety net. North Pole Security’s documentation suggests them for the management tools that must always run, even if the sync server sends something unexpected. They win over the rules from the sync server. The same page says Macs with a few thousand static rules have worked, but North Pole does not recommend using them that way.
The Santa integration page shows what Zentral does with Santa, and the Zentral Santa documentation covers the setup, the rules and the sync. If you have questions, contact us.