syntax for plist about santa HOT 2 CLOSED

Switching between blacklisting and whitelisting mode can be done with:

For monitor mode:
sudo defaults write /var/db/santa/config.plist ClientMode -int 1

For lockdown mode:
sudo defaults write /var/db/santa/config.plist ClientMode -int 2

Note: this must be done while santad is not running, otherwise it will be overridden.

To add rules you can use the santactl rule command. If you run santactl help rule it lists the available options but here's some examples:

sudo santactl rule add --whitelist --path /path/to/file
sudo santactl rule add --blacklist --sha256 aabbccddeeff...
sudo santactl rule add --blacklist --path /path/to/file --message "This file is blocked"
sudo santactl rule remove --sha256 aabbccddeeff...

from santa.

Thanks a lot Russell. That was very helpful!

from santa.