github northpolesec/santa 2025.6
v2025.6
on GitHub

latest releases: 2025.8, 2025.7
2 months ago

Notes

Important

The binaries initially uploaded for this release only contained the arm64 slice. We have updated the binaries to be universal and also include the x86_64 slice as well. You may need to re-download the latest binaries if deploying to Intel Macs.

If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade.

Santa documentation has undergone a complete overhaul and can be found at northpole.dev.

Announcements

📣 (BETA) Common Expression Language (CEL) has been added as a supported policy type! This is a powerful new feature that expands what can be expressed in a rule. Please see our CEL documentation for more details and examples, as well as the Rule schema for information on how to populate the expression.

  • North Pole Security Workshop customers have access to a fully integrated CEL evaluator and playground in the rule editor.

📣 We've created a Config Generator to help admins craft Santa configuration!

Fixed

❗ Overzealous caching of executables matching compiler rules could cause transitively created executables to not have rules automatically created
❗ On rare occasions, and only when transitive rules or standalone mode were enabled, Santa could potentially exclude some events from the EventUpload phase of syncing
❗ A very rare crash could occur if an XPC connection went invalid before it finished being established
❗ FAA rules with paths that contained glob characters could cause a memory leak

Changed

↔️ santactl status output, including JSON output via the --json flag, has been slightly changed to provide better data grouping and more consistent output across the groups
↔️ Log messages have been more tightly integrated into Apple's Unified Logging System, meaning the EnableDebugLogging configuration key is no longer needed. Debug logs can be viewed along with other log messages using appropriate arguments with the log(1) command.
↔️ Timestamps in santactl fileinfo now default to UTC. This can be changed to use the local system timezone by using the --localtz flag.
↔️ More Santa files are now included in the tamper resistance protections, including the rules and events databases and the sync state plist.
↔️ Rule information returned by santactl fileinfo and santactl rule now shows the matched rule, not the decision, since this is often heavily influenced by runtime information that isn't available during a static check
↔️ Links in the UnknownBlockMessage and BannedBlockMessage configuration keys that are displayed when an execution is blocked are now clickable

Added

➕ (BETA) Rules can now include CEL policies! See our CEL documentation for more details and examples.
➕ Santa now emits distributed notifications when FAA policy violations occur, similar to the notifications that are sent when executions are blocked.
➕ A clean sync can now be initiated from the "About" UI dialog by holding the Option key when clicking the "Sync" button
➕ Executable signing timestamps were added to sync preflight messages and santactl fileinfo output
➕ Paths for Proc FAA rules now also support glob characters in the same way as Data FAA rules.
➕ New checks were added to santactl doctor to look for potential sync server certificate and communication issues
➕ Primary user groups can now be defined by the MachineOwnerGroups or MachineOwnerGroupsKey configuration key. This value is included in preflight requests to allow sync servers to improve rule targeting.

What's Changed

Full Changelog: 2025.5...2025.6

Check out latest releases or
releases around northpolesec/santa 2025.6

Don't miss a new santa release

NewReleases is sending notifications on new releases.

Get notifications