Manage Santa within osquery

Summary: Trail of Bits, in partnership with Palantir, released an open-source osquery extension that manages Google Santa, the macOS application whitelist and blacklist system, without a separate sync server. The extension adds two tables, santa_rules (shasum, state, type) and santa_events (timestamp, path, shasum, reason), and depends on writable tables support for extensions that has not yet been merged.
Why it matters: Santa's sync server gave no way to confirm whether agents had pulled the latest rules or how often they blocked blacklisted binaries; this extension puts rules and deny events in one interface, but it relies on an unmerged osquery capability that currently requires a custom binary build.

Read the original at Trail of Bits Blog ↗