1

santactl status

1

sudo santactl rule --block --path /Applications/QQ.app/Contents/Resources/app/ScreenCaptureAgent.framework/Versions/A/ScreenCaptureAgent

1

santactl fileinfo /Applications/QQ.app/Contents/Resources/app/ScreenCaptureAgent.framework/Versions/A/ScreenCaptureAgent --key Rule

1
2
3
4
5
6
7
8
9
10
11
12
13

ls /var/db/santa 
santactl help
Usage: santactl:
	fileinfo - Prints information about a file.
	 metrics - Show Santa metric information.
	printlog - Prints the contents of Santa protobuf log files as JSON.
	    rule - Manually add/remove/check rules.
	  status - Show Santa status information.
	    sync - Synchronizes Santa with a configured server.
	 version - Show Santa component versions.

See 'santactl help <command>' to read about a specific subcommand.
santactl help rule 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

santactl help rule
Help for 'rule':
Usage: santactl rule [options]
  One of:
    --allow: add to allow
    --block: add to block
    --silent-block: add to silent block
    --compiler: allow and mark as a compiler
    --remove: remove existing rule
    --check: check for an existing rule
    --import: import rules from a JSON file
    --export: export rules to a JSON file

  One of:
    --path {path}: path of binary/bundle to add/remove.
                   Will add the hash of the file currently at that path.
                   Does not work with --check. Use the fileinfo verb to check.
                   the rule state of a file.
    --identifier {sha256|teamID|signingID}: identifier to add/remove/check
    --sha256 {sha256}: hash to add/remove/check [deprecated]
    --json {path}: path to a JSON file containing a list of rules to add/remove

  Optionally:
    --teamid: add or check a team ID rule instead of binary
    --signingid: add or check a signing ID rule instead of binary (see notes)
    --certificate: add or check a certificate sha256 rule instead of binary
    --message {message}: custom message

  Notes:
    The format of `identifier` when adding/checking a `signingid` rule is:

      `TeamID:SigningID`

    Because signing IDs are controlled by the binary author, this ensures
    that the signing ID is properly scoped to a developer. For the special
    case of platform binaries, `TeamID` should be replaced with the string
    "platform" (e.g. `platform:SigningID`). This allows for rules
    targeting Apple-signed binaries that do not have a team ID.

  Importing / Exporting Rules:
    If santa is not configured to use a sync server one can export
    & import its non-static rules to and from JSON files using the
    --export/--import flags. These files have the following form:

    {"rules": [{rule-dictionaries}]}
    e.g. {"rules": [
                      {"policy": "BLOCKLIST",
                       "identifier": "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
                       "custom_url" : "",
                       "custom_msg": "/bin/ls block for demo"}
                      ]}