Manage Santa within osquery

Published

2018-05-29 11:50

Collected

2026-07-03 04:32

---
id: 2038
title: "Manage Santa within osquery"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2018/05/29/manage-santa-within-osquery/"
published_at: "2018-05-29T11:50:31Z"
tags: ["endpoint-security", "macos", "osquery", "google-santa", "application-whitelisting", "writable-tables", "palantir"]
phying_url: "https://phying.com/item/2038"
lang: en
---

# Manage Santa within osquery

## Summary

Developed with Palantir, this osquery extension manages Google Santa's macOS application allow/block lists via santa_rules and santa_events tables, eliminating the need for a separate sync server.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2018-05-29T11:50:31Z
- **Original:** https://blog.trailofbits.com/2018/05/29/manage-santa-within-osquery/
- **Phying News:** https://phying.com/item/2038