syncv1

package
v1.36.12-2026081019041... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: unknown License: Apache-2.0 Imports: 5 Imported by: 4

Documentation ¶

Index ¶

Constants ¶

View Source 
const AuditEvent_Event_not_set_case case_AuditEvent_Event = 0
View Source 
const AuditEvent_StandaloneModeRuleCreation_case case_AuditEvent_Event = 1
View Source 
const RemovableMediaPolicy_Action_not_set_case case_RemovableMediaPolicy_Action = 0
View Source 
const RemovableMediaPolicy_Allow_case case_RemovableMediaPolicy_Action = 1
View Source 
const RemovableMediaPolicy_Block_case case_RemovableMediaPolicy_Action = 2
View Source 
const RemovableMediaPolicy_Remount_case case_RemovableMediaPolicy_Action = 3

Variables ¶

View Source 
var (
	ClientMode_name = map[int32]string{
		0: "UNKNOWN_CLIENT_MODE",
		1: "MONITOR",
		2: "LOCKDOWN",
		3: "STANDALONE",
	}
	ClientMode_value = map[string]int32{
		"UNKNOWN_CLIENT_MODE": 0,
		"MONITOR":             1,
		"LOCKDOWN":            2,
		"STANDALONE":          3,
	}
)

Enum value maps for ClientMode.

View Source 
var (
	SyncType_name = map[int32]string{
		0: "SYNC_TYPE_UNSPECIFIED",
		1: "NORMAL",

		2: "CLEAN",

		3: "CLEAN_ALL",

		4: "CLEAN_STANDALONE",
		5: "CLEAN_RULES",
		6: "CLEAN_FILE_ACCESS_RULES",
	}
	SyncType_value = map[string]int32{
		"SYNC_TYPE_UNSPECIFIED":   0,
		"NORMAL":                  1,
		"normal":                  1,
		"CLEAN":                   2,
		"clean":                   2,
		"CLEAN_ALL":               3,
		"clean_all":               3,
		"CLEAN_STANDALONE":        4,
		"CLEAN_RULES":             5,
		"CLEAN_FILE_ACCESS_RULES": 6,
	}
)

Enum value maps for SyncType.

View Source 
var (
	FileAccessAction_name = map[int32]string{
		0: "FILE_ACCESS_ACTION_UNSPECIFIED",
		1: "NONE",

		2: "AUDIT_ONLY",

		3: "DISABLE",
	}
	FileAccessAction_value = map[string]int32{
		"FILE_ACCESS_ACTION_UNSPECIFIED": 0,
		"NONE":                           1,
		"None":                           1,
		"AUDIT_ONLY":                     2,
		"AuditOnly":                      2,
		"DISABLE":                        3,
		"Disable":                        3,
	}
)

Enum value maps for FileAccessAction.

View Source 
var (
	Decision_name = map[int32]string{
		0:  "DECISION_UNKNOWN",
		1:  "ALLOW_UNKNOWN",
		2:  "ALLOW_BINARY",
		3:  "ALLOW_CERTIFICATE",
		4:  "ALLOW_SCOPE",
		5:  "ALLOW_TEAMID",
		6:  "ALLOW_SIGNINGID",
		7:  "ALLOW_CDHASH",
		8:  "BLOCK_UNKNOWN",
		9:  "BLOCK_BINARY",
		10: "BLOCK_CERTIFICATE",
		11: "BLOCK_SCOPE",
		12: "BLOCK_TEAMID",
		13: "BLOCK_SIGNINGID",
		14: "BLOCK_CDHASH",
		15: "BUNDLE_BINARY",
		18: "BLOCK_BINARY_MISMATCH",
		19: "ALLOW_PLATFORM",
	}
	Decision_value = map[string]int32{
		"DECISION_UNKNOWN":      0,
		"ALLOW_UNKNOWN":         1,
		"ALLOW_BINARY":          2,
		"ALLOW_CERTIFICATE":     3,
		"ALLOW_SCOPE":           4,
		"ALLOW_TEAMID":          5,
		"ALLOW_SIGNINGID":       6,
		"ALLOW_CDHASH":          7,
		"BLOCK_UNKNOWN":         8,
		"BLOCK_BINARY":          9,
		"BLOCK_CERTIFICATE":     10,
		"BLOCK_SCOPE":           11,
		"BLOCK_TEAMID":          12,
		"BLOCK_SIGNINGID":       13,
		"BLOCK_CDHASH":          14,
		"BUNDLE_BINARY":         15,
		"BLOCK_BINARY_MISMATCH": 18,
		"ALLOW_PLATFORM":        19,
	}
)

Enum value maps for Decision.

View Source 
var (
	SigningStatus_name = map[int32]string{
		0: "SIGNING_STATUS_UNSPECIFIED",
		1: "SIGNING_STATUS_UNSIGNED",
		2: "SIGNING_STATUS_INVALID",
		3: "SIGNING_STATUS_ADHOC",
		4: "SIGNING_STATUS_DEVELOPMENT",
		5: "SIGNING_STATUS_PRODUCTION",
	}
	SigningStatus_value = map[string]int32{
		"SIGNING_STATUS_UNSPECIFIED": 0,
		"SIGNING_STATUS_UNSIGNED":    1,
		"SIGNING_STATUS_INVALID":     2,
		"SIGNING_STATUS_ADHOC":       3,
		"SIGNING_STATUS_DEVELOPMENT": 4,
		"SIGNING_STATUS_PRODUCTION":  5,
	}
)

Enum value maps for SigningStatus.

View Source 
var (
	FileAccessDecision_name = map[int32]string{
		0: "FILE_ACCESS_DECISION_UNKNOWN",
		1: "FILE_ACCESS_DECISION_DENIED",
		2: "FILE_ACCESS_DECISION_DENIED_INVALID_SIGNATURE",
		3: "FILE_ACCESS_DECISION_AUDIT_ONLY",
	}
	FileAccessDecision_value = map[string]int32{
		"FILE_ACCESS_DECISION_UNKNOWN":                  0,
		"FILE_ACCESS_DECISION_DENIED":                   1,
		"FILE_ACCESS_DECISION_DENIED_INVALID_SIGNATURE": 2,
		"FILE_ACCESS_DECISION_AUDIT_ONLY":               3,
	}
)

Enum value maps for FileAccessDecision.

View Source 
var (
	Policy_name = map[int32]string{
		0: "POLICY_UNKNOWN",
		1: "ALLOWLIST",
		2: "ALLOWLIST_COMPILER",
		3: "BLOCKLIST",
		4: "SILENT_BLOCKLIST",
		5: "REMOVE",
		6: "CEL",
		8: "SILENT_GUI_BLOCKLIST",
		9: "SILENT_TTY_BLOCKLIST",
	}
	Policy_value = map[string]int32{
		"POLICY_UNKNOWN":       0,
		"ALLOWLIST":            1,
		"ALLOWLIST_COMPILER":   2,
		"BLOCKLIST":            3,
		"SILENT_BLOCKLIST":     4,
		"REMOVE":               5,
		"CEL":                  6,
		"SILENT_GUI_BLOCKLIST": 8,
		"SILENT_TTY_BLOCKLIST": 9,
		"WHITELIST":            1,
		"WHITELIST_COMPILER":   2,
		"BLACKLIST":            3,
		"SILENT_BLACKLIST":     4,
	}
)

Enum value maps for Policy.

View Source 
var (
	RuleType_name = map[int32]string{
		0: "RULETYPE_UNKNOWN",
		1: "BINARY",
		2: "CERTIFICATE",
		3: "TEAMID",
		4: "SIGNINGID",
		5: "CDHASH",
	}
	RuleType_value = map[string]int32{
		"RULETYPE_UNKNOWN": 0,
		"BINARY":           1,
		"CERTIFICATE":      2,
		"TEAMID":           3,
		"SIGNINGID":        4,
		"CDHASH":           5,
	}
)

Enum value maps for RuleType.

View Source 
var File_sync_v1_proto protoreflect.FileDescriptor

Functions ¶

This section is empty.

Types ¶

type AuditEvent ¶ 

type AuditEvent struct {

	// Types that are valid to be assigned to Event:
	//
	//	*AuditEvent_StandaloneModeRuleCreation
	Event isAuditEvent_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

AuditEvents are events sent by Santa to communicate context to the sync service.

func (*AuditEvent) ClearEvent ¶ 

func (x *AuditEvent) ClearEvent()

func (*AuditEvent) ClearStandaloneModeRuleCreation ¶ 

func (x *AuditEvent) ClearStandaloneModeRuleCreation()

func (*AuditEvent) GetEvent ¶ 

func (x *AuditEvent) GetEvent() isAuditEvent_Event

func (*AuditEvent) GetStandaloneModeRuleCreation ¶ 

func (x *AuditEvent) GetStandaloneModeRuleCreation() *StandaloneModeRuleCreation

func (*AuditEvent) HasEvent ¶ 

func (x *AuditEvent) HasEvent() bool

func (*AuditEvent) HasStandaloneModeRuleCreation ¶ 

func (x *AuditEvent) HasStandaloneModeRuleCreation() bool

func (*AuditEvent) ProtoMessage ¶ 

func (*AuditEvent) ProtoMessage()

func (*AuditEvent) ProtoReflect ¶ 

func (x *AuditEvent) ProtoReflect() protoreflect.Message

func (*AuditEvent) Reset ¶ 

func (x *AuditEvent) Reset()

func (*AuditEvent) SetStandaloneModeRuleCreation ¶ 

func (x *AuditEvent) SetStandaloneModeRuleCreation(v *StandaloneModeRuleCreation)

func (*AuditEvent) String ¶ 

func (x *AuditEvent) String() string

func (*AuditEvent) WhichEvent ¶ 

func (x *AuditEvent) WhichEvent() case_AuditEvent_Event

type AuditEvent_StandaloneModeRuleCreation ¶ 

type AuditEvent_StandaloneModeRuleCreation struct {
	StandaloneModeRuleCreation *StandaloneModeRuleCreation `protobuf:"bytes,1,opt,name=standalone_mode_rule_creation,proto3,oneof"`
}

type AuditEvent_builder ¶ 

type AuditEvent_builder struct {

	// Fields of oneof Event:
	StandaloneModeRuleCreation *StandaloneModeRuleCreation
	// contains filtered or unexported fields
}

func (AuditEvent_builder) Build ¶ 

func (b0 AuditEvent_builder) Build() *AuditEvent

type Certificate ¶ 

type Certificate struct {

	// The SHA-256 of the certificate contents.
	Sha256 string `protobuf:"bytes,1,opt,name=sha256,proto3" json:"sha256,omitempty"`
	// The Common Name field of the certificate.
	Cn string `protobuf:"bytes,2,opt,name=cn,proto3" json:"cn,omitempty"`
	// The Organization field of the certificate.
	Org string `protobuf:"bytes,3,opt,name=org,proto3" json:"org,omitempty"`
	// The Organizational Unit field of the certificate.
	Ou string `protobuf:"bytes,4,opt,name=ou,proto3" json:"ou,omitempty"`
	// The Valid From field of the certificate, represented as the number of
	// seconds since the UNIX epoch.
	ValidFrom uint32 `protobuf:"varint,5,opt,name=valid_from,proto3" json:"valid_from,omitempty"`
	// The Valid Until field of the certificate, represented as the number of
	// seconds since the UNIX epoch.
	ValidUntil uint32 `protobuf:"varint,6,opt,name=valid_until,proto3" json:"valid_until,omitempty"`
	// contains filtered or unexported fields
}

func (*Certificate) GetCn ¶ 

func (x *Certificate) GetCn() string

func (*Certificate) GetOrg ¶ 

func (x *Certificate) GetOrg() string

func (*Certificate) GetOu ¶ 

func (x *Certificate) GetOu() string

func (*Certificate) GetSha256 ¶ 

func (x *Certificate) GetSha256() string

func (*Certificate) GetValidFrom ¶ 

func (x *Certificate) GetValidFrom() uint32

func (*Certificate) GetValidUntil ¶ 

func (x *Certificate) GetValidUntil() uint32

func (*Certificate) ProtoMessage ¶ 

func (*Certificate) ProtoMessage()

func (*Certificate) ProtoReflect ¶ 

func (x *Certificate) ProtoReflect() protoreflect.Message

func (*Certificate) Reset ¶ 

func (x *Certificate) Reset()

func (*Certificate) SetCn ¶ 

func (x *Certificate) SetCn(v string)

func (*Certificate) SetOrg ¶ 

func (x *Certificate) SetOrg(v string)

func (*Certificate) SetOu ¶ 

func (x *Certificate) SetOu(v string)

func (*Certificate) SetSha256 ¶ 

func (x *Certificate) SetSha256(v string)

func (*Certificate) SetValidFrom ¶ 

func (x *Certificate) SetValidFrom(v uint32)

func (*Certificate) SetValidUntil ¶ 

func (x *Certificate) SetValidUntil(v uint32)

func (*Certificate) String ¶ 

func (x *Certificate) String() string

type Certificate_builder ¶ 

type Certificate_builder struct {

	// The SHA-256 of the certificate contents.
	Sha256 string
	// The Common Name field of the certificate.
	Cn string
	// The Organization field of the certificate.
	Org string
	// The Organizational Unit field of the certificate.
	Ou string
	// The Valid From field of the certificate, represented as the number of
	// seconds since the UNIX epoch.
	ValidFrom uint32
	// The Valid Until field of the certificate, represented as the number of
	// seconds since the UNIX epoch.
	ValidUntil uint32
	// contains filtered or unexported fields
}

func (Certificate_builder) Build ¶ 

func (b0 Certificate_builder) Build() *Certificate

type ClientMode ¶ 

type ClientMode int32

ClientMode represents the operating mode for an agent. 

const (
	ClientMode_UNKNOWN_CLIENT_MODE ClientMode = 0
	// In MONITOR mode, any execution that doesn't match a rule or configuration
	// will be allowed.
	ClientMode_MONITOR ClientMode = 1
	// In LOCKDOWN mode, any execution that doesn't match a rule or configuration
	// will be blocked.
	ClientMode_LOCKDOWN ClientMode = 2
	// In STANDALONE mode, any execution that doesn't match a rule or
	// configuration will be blocked but the user will be able to approve the
	// execution by authenticating.
	ClientMode_STANDALONE ClientMode = 3
)

func (ClientMode) Descriptor ¶ 

func (ClientMode) Descriptor() protoreflect.EnumDescriptor

func (ClientMode) Enum ¶ 

func (x ClientMode) Enum() *ClientMode

func (ClientMode) Number ¶ 

func (x ClientMode) Number() protoreflect.EnumNumber

func (ClientMode) String ¶ 

func (x ClientMode) String() string

func (ClientMode) Type ¶ 

func (ClientMode) Type() protoreflect.EnumType

type Decision ¶ 

type Decision int32

The Decision enum records what decision Santa made about an execution. 

const (
	Decision_DECISION_UNKNOWN Decision = 0
	// The execution was allowed because no specific rule matched and the host is
	// in MONITOR mode.
	Decision_ALLOW_UNKNOWN Decision = 1
	// The execution was allowed because of a BINARY rule.
	Decision_ALLOW_BINARY Decision = 2
	// The execution was allowed because the binary was signed by a certificate
	// matching a CERTIFICATE rule.
	Decision_ALLOW_CERTIFICATE Decision = 3
	// The execution was allowed because the executable matched an allowed scope.
	// At present this includes paths matching a configured AllowedPathRegex or
	// scripts.
	Decision_ALLOW_SCOPE Decision = 4
	// The execution was allowed because the binary was signed by a certificate
	// matching a TEAMID rule.
	Decision_ALLOW_TEAMID Decision = 5
	// The execution was allowed because the binary matched a SIGNINGID rule,
	Decision_ALLOW_SIGNINGID Decision = 6
	// The execution was allowed because the binary matched a CDHASH rule.
	Decision_ALLOW_CDHASH Decision = 7
	// The execution was blocked because no specific rule matched and the host is
	// in LOCKDOWN mode.
	Decision_BLOCK_UNKNOWN Decision = 8
	// The execution was blocked because of a BINARY rule.
	Decision_BLOCK_BINARY Decision = 9
	// The execution was blocked because the binary was signed by a certificate
	// matching a CERTIFICATE rule.
	Decision_BLOCK_CERTIFICATE Decision = 10
	// The execution was blocked because the executable matched a blocked scope.
	// At present this includes paths matching a configured BlockedPathRegex or
	// because EnablePageZeroProtection is turned on and the binary is missing
	// a __PAGEZERO segment (very rare).
	Decision_BLOCK_SCOPE Decision = 11
	// The execution was blocked because the binary was signed by a certificate
	// matching a TEAMID rule.
	Decision_BLOCK_TEAMID Decision = 12
	// The execution was blocked because the binary matched a SIGNINGID rule,
	Decision_BLOCK_SIGNINGID Decision = 13
	// The execution was blocked because the binary matched a CDHASH rule.
	Decision_BLOCK_CDHASH Decision = 14
	// BUNDLE_BINARY events don't represent an execution but are sent to a server
	// that requested details about all of the binaries contained within a bundle.
	Decision_BUNDLE_BINARY Decision = 15
	// The execution was blocked because the kernel's view of the binary
	// disagreed with Santa's on-disk view at policy-evaluation time.
	Decision_BLOCK_BINARY_MISMATCH Decision = 18
	// The execution was allowed because the binary is considered a platform
	// binary and no rule or CEL fallback policy matched.
	Decision_ALLOW_PLATFORM Decision = 19
)

func (Decision) Descriptor ¶ 

func (Decision) Descriptor() protoreflect.EnumDescriptor

func (Decision) Enum ¶ 

func (x Decision) Enum() *Decision

func (Decision) Number ¶ 

func (x Decision) Number() protoreflect.EnumNumber

func (Decision) String ¶ 

func (x Decision) String() string

func (Decision) Type ¶ 

func (Decision) Type() protoreflect.EnumType

type Entitlement ¶ 

type Entitlement struct {

	// The name of an entitlement.
	Key *string `protobuf:"bytes,1,opt,name=key,proto3,oneof" json:"key,omitempty"`
	// The value of an entitlement. This will generally be either true, false, or
	// a JSON object. A value of false means that the entitlement is not really
	// claimed and can be ignored (but is reported for informational purposes).
	Value *string `protobuf:"bytes,2,opt,name=value,proto3,oneof" json:"value,omitempty"`
	// contains filtered or unexported fields
}

Information about a single entitlement key/value pair

func (*Entitlement) ClearKey ¶ 

func (x *Entitlement) ClearKey()

func (*Entitlement) ClearValue ¶ 

func (x *Entitlement) ClearValue()

func (*Entitlement) GetKey ¶ 

func (x *Entitlement) GetKey() string

func (*Entitlement) GetValue ¶ 

func (x *Entitlement) GetValue() string

func (*Entitlement) HasKey ¶ 

func (x *Entitlement) HasKey() bool

func (*Entitlement) HasValue ¶ 

func (x *Entitlement) HasValue() bool

func (*Entitlement) ProtoMessage ¶ 

func (*Entitlement) ProtoMessage()

func (*Entitlement) ProtoReflect ¶ 

func (x *Entitlement) ProtoReflect() protoreflect.Message

func (*Entitlement) Reset ¶ 

func (x *Entitlement) Reset()

func (*Entitlement) SetKey ¶ 

func (x *Entitlement) SetKey(v string)

func (*Entitlement) SetValue ¶ 

func (x *Entitlement) SetValue(v string)

func (*Entitlement) String ¶ 

func (x *Entitlement) String() string

type EntitlementInfo ¶ 

type EntitlementInfo struct {

	// Whether or not the set of reported entitlements is complete or has been
	// filtered (e.g. by configuration or clipped because too many to log).
	EntitlementsFiltered *bool `` /* 128-byte string literal not displayed */
	// The set of entitlements associated with the target executable
	// Only top level keys are represented
	// Values (including nested keys) are JSON serialized
	Entitlements []*Entitlement `protobuf:"bytes,2,rep,name=entitlements,proto3" json:"entitlements,omitempty"`
	// contains filtered or unexported fields
}

Information about entitlements

func (*EntitlementInfo) ClearEntitlementsFiltered ¶ 

func (x *EntitlementInfo) ClearEntitlementsFiltered()

func (*EntitlementInfo) GetEntitlements ¶ 

func (x *EntitlementInfo) GetEntitlements() []*Entitlement

func (*EntitlementInfo) GetEntitlementsFiltered ¶ 

func (x *EntitlementInfo) GetEntitlementsFiltered() bool

func (*EntitlementInfo) HasEntitlementsFiltered ¶ 

func (x *EntitlementInfo) HasEntitlementsFiltered() bool

func (*EntitlementInfo) ProtoMessage ¶ 

func (*EntitlementInfo) ProtoMessage()

func (*EntitlementInfo) ProtoReflect ¶ 

func (x *EntitlementInfo) ProtoReflect() protoreflect.Message

func (*EntitlementInfo) Reset ¶ 

func (x *EntitlementInfo) Reset()

func (*EntitlementInfo) SetEntitlements ¶ 

func (x *EntitlementInfo) SetEntitlements(v []*Entitlement)

func (*EntitlementInfo) SetEntitlementsFiltered ¶ 

func (x *EntitlementInfo) SetEntitlementsFiltered(v bool)

func (*EntitlementInfo) String ¶ 

func (x *EntitlementInfo) String() string

type EntitlementInfo_builder ¶ 

type EntitlementInfo_builder struct {

	// Whether or not the set of reported entitlements is complete or has been
	// filtered (e.g. by configuration or clipped because too many to log).
	EntitlementsFiltered *bool
	// The set of entitlements associated with the target executable
	// Only top level keys are represented
	// Values (including nested keys) are JSON serialized
	Entitlements []*Entitlement
	// contains filtered or unexported fields
}

func (EntitlementInfo_builder) Build ¶ 

func (b0 EntitlementInfo_builder) Build() *EntitlementInfo

type Entitlement_builder ¶ 

type Entitlement_builder struct {

	// The name of an entitlement.
	Key *string
	// The value of an entitlement. This will generally be either true, false, or
	// a JSON object. A value of false means that the entitlement is not really
	// claimed and can be ignored (but is reported for informational purposes).
	Value *string
	// contains filtered or unexported fields
}

func (Entitlement_builder) Build ¶ 

func (b0 Entitlement_builder) Build() *Entitlement

type Event ¶ 

type Event struct {

	// The SHA-256 of the binary file being executed.
	FileSha256 string `protobuf:"bytes,1,opt,name=file_sha256,proto3" json:"file_sha256,omitempty"`
	// The path containing this binary, e.g. /usr/bin
	FilePath string `protobuf:"bytes,2,opt,name=file_path,proto3" json:"file_path,omitempty"`
	// The name of the binary file, e.g. yes
	FileName string `protobuf:"bytes,3,opt,name=file_name,proto3" json:"file_name,omitempty"`
	// The user that executed the binary.
	ExecutingUser string `protobuf:"bytes,4,opt,name=executing_user,proto3" json:"executing_user,omitempty"`
	// The time of the execution, represented as the number of seconds since the
	// UNIX epoch. As a double-precision floating point number it can represent
	// submultiples in its fraction.
	ExecutionTime float64 `protobuf:"fixed64,5,opt,name=execution_time,proto3" json:"execution_time,omitempty"`
	// The set of users logged in at the time of the execution.
	LoggedInUsers []string `protobuf:"bytes,6,rep,name=logged_in_users,proto3" json:"logged_in_users,omitempty"`
	// The set of sessions at the time of execution.
	//
	//   - A user logged into the GUI will be shown as user@console
	//   - A user logged into a local terminal will be shown as user@ttyS000
	//   - A user logged in over SSH will be shown as user@IP
	CurrentSessions []string `protobuf:"bytes,7,rep,name=current_sessions,proto3" json:"current_sessions,omitempty"`
	// The decision that was made. See the comments on the Decision enum for
	// interpreting this value.
	Decision Decision `protobuf:"varint,8,opt,name=decision,proto3,enum=santa.sync.v1.Decision" json:"decision,omitempty"`
	// If the executed file is part of a bundle, this field is the
	// CFBundleIdentifier, e.g. com.northpolesec.santa.
	FileBundleId string `protobuf:"bytes,9,opt,name=file_bundle_id,proto3" json:"file_bundle_id,omitempty"`
	// If the executed file is part of a bundle, this field is the path of the
	// bundle. E.g. if the binary is at /Applications/Acme.app/Contents/MacOS/Acme
	// then the bundle path will be /Applications/Acme.app.
	FileBundlePath string `protobuf:"bytes,10,opt,name=file_bundle_path,proto3" json:"file_bundle_path,omitempty"`
	// If the executed file is part of a bundle, this field is the path of the
	// executing binary relative to the root of the bundle. E.g. if the binary is
	// at /Applications/Acme.app/Contents/MacOS/Acme then this field will be
	// Contents/MacOS/Acme.
	FileBundleExecutableRelPath string `protobuf:"bytes,11,opt,name=file_bundle_executable_rel_path,proto3" json:"file_bundle_executable_rel_path,omitempty"`
	// If the executed file is part of a bundle, this field will be the
	// CFBundleName of the bundle.
	FileBundleName string `protobuf:"bytes,12,opt,name=file_bundle_name,proto3" json:"file_bundle_name,omitempty"`
	// If the executed file is part of a bundle, this field will be set to the
	// CFBundleVersion of the bundle.
	FileBundleVersion string `protobuf:"bytes,13,opt,name=file_bundle_version,proto3" json:"file_bundle_version,omitempty"`
	// If the executed file is part of a bundle, this field will be set to the
	// CFBundleShortVersionString of the bundle.
	FileBundleVersionString string `protobuf:"bytes,14,opt,name=file_bundle_version_string,proto3" json:"file_bundle_version_string,omitempty"`
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the calculated hash of the bundle.
	FileBundleHash string `protobuf:"bytes,15,opt,name=file_bundle_hash,proto3" json:"file_bundle_hash,omitempty"`
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the number of milliseconds that
	// santabundleservice spend discovering all of the binaries inside the bundle
	// and hashing them to create the bundle hash.
	FileBundleHashMillis uint32 `protobuf:"varint,16,opt,name=file_bundle_hash_millis,proto3" json:"file_bundle_hash_millis,omitempty"`
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the number of binaries that were discovered in
	// the bundle.
	FileBundleBinaryCount uint32 `protobuf:"varint,17,opt,name=file_bundle_binary_count,proto3" json:"file_bundle_binary_count,omitempty"`
	// The pid of the execution (regardless of whether it was allowed or denied).
	Pid int32 `protobuf:"varint,18,opt,name=pid,proto3" json:"pid,omitempty"`
	// The parent pid of the execution.
	Ppid int32 `protobuf:"varint,19,opt,name=ppid,proto3" json:"ppid,omitempty"`
	// The name of the parent process.
	ParentName string `protobuf:"bytes,20,opt,name=parent_name,proto3" json:"parent_name,omitempty"`
	// The team ID of the binary being executed.
	TeamId string `protobuf:"bytes,21,opt,name=team_id,proto3" json:"team_id,omitempty"`
	// The signing ID of the binary being executed.
	// For binaries that are part of macOS this will be prefixed with platform:
	// For binaries that are signed by a valid developer certificate this will
	//
	//	be prefixed with the signer's team ID.
	SigningId string `protobuf:"bytes,22,opt,name=signing_id,proto3" json:"signing_id,omitempty"`
	// The CDHash of the binary, if it is validly signed.
	Cdhash string `protobuf:"bytes,23,opt,name=cdhash,proto3" json:"cdhash,omitempty"`
	// The URL that the executing binary was downloaded from, if the binary had
	// been quarantined at the time of download.
	// As of macOS 12, this data is usually not retrievable and this field will
	// not be populated, so it has been marked deprecated.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineDataUrl string `protobuf:"bytes,24,opt,name=quarantine_data_url,proto3" json:"quarantine_data_url,omitempty"`
	// The referring URL that led to the URL the binary was downloaded from, if
	// the binary had been quarantined at the time of download.
	// As of macOS 12, this data is usually not retrievable and this field will
	// not be populated.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineRefererUrl string `protobuf:"bytes,25,opt,name=quarantine_referer_url,proto3" json:"quarantine_referer_url,omitempty"`
	// Seconds since UNIX epoch. This field would ideally be an int64 but the
	// protobuf library encodes that as a string, unlike NSJSONSerialization.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineTimestamp uint32 `protobuf:"varint,26,opt,name=quarantine_timestamp,proto3" json:"quarantine_timestamp,omitempty"`
	// If the binary was quarantined, this field contains the bundle ID of the
	// agent that downloaded the binary, e.g. com.google.Chrome.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineAgentBundleId string `protobuf:"bytes,27,opt,name=quarantine_agent_bundle_id,proto3" json:"quarantine_agent_bundle_id,omitempty"`
	// If the binary is properly signed, this field contains details of all of
	// the certificates in the signing chain, starting at the leaf certificate
	// (the one that directly signed the binary) leading up to a root.
	SigningChain []*Certificate `protobuf:"bytes,28,rep,name=signing_chain,proto3" json:"signing_chain,omitempty"`
	// Entitlement information about the target executable.
	EntitlementInfo *EntitlementInfo `protobuf:"bytes,29,opt,name=entitlement_info,json=entitlementInfo,proto3" json:"entitlement_info,omitempty"`
	// The raw codesigning flags set for the execution.
	CsFlags uint32 `protobuf:"varint,30,opt,name=cs_flags,json=csFlags,proto3" json:"cs_flags,omitempty"`
	// The signing status of the executing binary. This is calculated from the
	// cs_flags field but is generally easier to utilize.
	SigningStatus SigningStatus `` /* 135-byte string literal not displayed */
	// The secure timestamp of when this binary was signed, as provided by the
	// timestamp service. Not populated for unsigned or ad-hoc signed binaries,
	// or if the secure timestamp is missing.
	// Number of seconds since UNIX epoch.
	SecureSigningTime uint32 `protobuf:"varint,32,opt,name=secure_signing_time,json=secureSigningTime,proto3" json:"secure_signing_time,omitempty"`
	// The timestamp provided by the developer when this binary was signed.
	// It is possible for developers to set this to whatever they wish when signing
	// unlike the secure_signing_time.
	// Number of seconds since UNIX epoch.
	SigningTime uint32 `protobuf:"varint,33,opt,name=signing_time,json=signingTime,proto3" json:"signing_time,omitempty"`
	// This flag indicates that a StaticRule was applied to this event
	StaticRule bool `protobuf:"varint,34,opt,name=static_rule,proto3" json:"static_rule,omitempty"`
	// contains filtered or unexported fields
}

func (*Event) ClearEntitlementInfo ¶ 

func (x *Event) ClearEntitlementInfo()

func (*Event) GetCdhash ¶ 

func (x *Event) GetCdhash() string

func (*Event) GetCsFlags ¶ 

func (x *Event) GetCsFlags() uint32

func (*Event) GetCurrentSessions ¶ 

func (x *Event) GetCurrentSessions() []string

func (*Event) GetDecision ¶ 

func (x *Event) GetDecision() Decision

func (*Event) GetEntitlementInfo ¶ 

func (x *Event) GetEntitlementInfo() *EntitlementInfo

func (*Event) GetExecutingUser ¶ 

func (x *Event) GetExecutingUser() string

func (*Event) GetExecutionTime ¶ 

func (x *Event) GetExecutionTime() float64

func (*Event) GetFileBundleBinaryCount ¶ 

func (x *Event) GetFileBundleBinaryCount() uint32

func (*Event) GetFileBundleExecutableRelPath ¶ 

func (x *Event) GetFileBundleExecutableRelPath() string

func (*Event) GetFileBundleHash ¶ 

func (x *Event) GetFileBundleHash() string

func (*Event) GetFileBundleHashMillis ¶ 

func (x *Event) GetFileBundleHashMillis() uint32

func (*Event) GetFileBundleId ¶ 

func (x *Event) GetFileBundleId() string

func (*Event) GetFileBundleName ¶ 

func (x *Event) GetFileBundleName() string

func (*Event) GetFileBundlePath ¶ 

func (x *Event) GetFileBundlePath() string

func (*Event) GetFileBundleVersion ¶ 

func (x *Event) GetFileBundleVersion() string

func (*Event) GetFileBundleVersionString ¶ 

func (x *Event) GetFileBundleVersionString() string

func (*Event) GetFileName ¶ 

func (x *Event) GetFileName() string

func (*Event) GetFilePath ¶ 

func (x *Event) GetFilePath() string

func (*Event) GetFileSha256 ¶ 

func (x *Event) GetFileSha256() string

func (*Event) GetLoggedInUsers ¶ 

func (x *Event) GetLoggedInUsers() []string

func (*Event) GetParentName ¶ 

func (x *Event) GetParentName() string

func (*Event) GetPid ¶ 

func (x *Event) GetPid() int32

func (*Event) GetPpid ¶ 

func (x *Event) GetPpid() int32

func (*Event) GetQuarantineAgentBundleId deprecated 

func (x *Event) GetQuarantineAgentBundleId() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) GetQuarantineDataUrl deprecated 

func (x *Event) GetQuarantineDataUrl() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) GetQuarantineRefererUrl deprecated 

func (x *Event) GetQuarantineRefererUrl() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) GetQuarantineTimestamp deprecated 

func (x *Event) GetQuarantineTimestamp() uint32

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) GetSecureSigningTime ¶ 

func (x *Event) GetSecureSigningTime() uint32

func (*Event) GetSigningChain ¶ 

func (x *Event) GetSigningChain() []*Certificate

func (*Event) GetSigningId ¶ 

func (x *Event) GetSigningId() string

func (*Event) GetSigningStatus ¶ 

func (x *Event) GetSigningStatus() SigningStatus

func (*Event) GetSigningTime ¶ 

func (x *Event) GetSigningTime() uint32

func (*Event) GetStaticRule ¶ 

func (x *Event) GetStaticRule() bool

func (*Event) GetTeamId ¶ 

func (x *Event) GetTeamId() string

func (*Event) HasEntitlementInfo ¶ 

func (x *Event) HasEntitlementInfo() bool

func (*Event) ProtoMessage ¶ 

func (*Event) ProtoMessage()

func (*Event) ProtoReflect ¶ 

func (x *Event) ProtoReflect() protoreflect.Message

func (*Event) Reset ¶ 

func (x *Event) Reset()

func (*Event) SetCdhash ¶ 

func (x *Event) SetCdhash(v string)

func (*Event) SetCsFlags ¶ 

func (x *Event) SetCsFlags(v uint32)

func (*Event) SetCurrentSessions ¶ 

func (x *Event) SetCurrentSessions(v []string)

func (*Event) SetDecision ¶ 

func (x *Event) SetDecision(v Decision)

func (*Event) SetEntitlementInfo ¶ 

func (x *Event) SetEntitlementInfo(v *EntitlementInfo)

func (*Event) SetExecutingUser ¶ 

func (x *Event) SetExecutingUser(v string)

func (*Event) SetExecutionTime ¶ 

func (x *Event) SetExecutionTime(v float64)

func (*Event) SetFileBundleBinaryCount ¶ 

func (x *Event) SetFileBundleBinaryCount(v uint32)

func (*Event) SetFileBundleExecutableRelPath ¶ 

func (x *Event) SetFileBundleExecutableRelPath(v string)

func (*Event) SetFileBundleHash ¶ 

func (x *Event) SetFileBundleHash(v string)

func (*Event) SetFileBundleHashMillis ¶ 

func (x *Event) SetFileBundleHashMillis(v uint32)

func (*Event) SetFileBundleId ¶ 

func (x *Event) SetFileBundleId(v string)

func (*Event) SetFileBundleName ¶ 

func (x *Event) SetFileBundleName(v string)

func (*Event) SetFileBundlePath ¶ 

func (x *Event) SetFileBundlePath(v string)

func (*Event) SetFileBundleVersion ¶ 

func (x *Event) SetFileBundleVersion(v string)

func (*Event) SetFileBundleVersionString ¶ 

func (x *Event) SetFileBundleVersionString(v string)

func (*Event) SetFileName ¶ 

func (x *Event) SetFileName(v string)

func (*Event) SetFilePath ¶ 

func (x *Event) SetFilePath(v string)

func (*Event) SetFileSha256 ¶ 

func (x *Event) SetFileSha256(v string)

func (*Event) SetLoggedInUsers ¶ 

func (x *Event) SetLoggedInUsers(v []string)

func (*Event) SetParentName ¶ 

func (x *Event) SetParentName(v string)

func (*Event) SetPid ¶ 

func (x *Event) SetPid(v int32)

func (*Event) SetPpid ¶ 

func (x *Event) SetPpid(v int32)

func (*Event) SetQuarantineAgentBundleId deprecated 

func (x *Event) SetQuarantineAgentBundleId(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) SetQuarantineDataUrl deprecated 

func (x *Event) SetQuarantineDataUrl(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) SetQuarantineRefererUrl deprecated 

func (x *Event) SetQuarantineRefererUrl(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) SetQuarantineTimestamp deprecated 

func (x *Event) SetQuarantineTimestamp(v uint32)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Event) SetSecureSigningTime ¶ 

func (x *Event) SetSecureSigningTime(v uint32)

func (*Event) SetSigningChain ¶ 

func (x *Event) SetSigningChain(v []*Certificate)

func (*Event) SetSigningId ¶ 

func (x *Event) SetSigningId(v string)

func (*Event) SetSigningStatus ¶ 

func (x *Event) SetSigningStatus(v SigningStatus)

func (*Event) SetSigningTime ¶ 

func (x *Event) SetSigningTime(v uint32)

func (*Event) SetStaticRule ¶ 

func (x *Event) SetStaticRule(v bool)

func (*Event) SetTeamId ¶ 

func (x *Event) SetTeamId(v string)

func (*Event) String ¶ 

func (x *Event) String() string

type EventUploadRequest ¶ 

type EventUploadRequest struct {

	// The set of execution events being uploaded.
	Events []*Event `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
	// A possible set of AuditEvents.
	AuditEvents []*AuditEvent `protobuf:"bytes,3,rep,name=audit_events,proto3" json:"audit_events,omitempty"`
	// The set of FileAccess events being uploaded.
	FileAccessEvents []*FileAccessEvent `protobuf:"bytes,4,rep,name=file_access_events,proto3" json:"file_access_events,omitempty"`
	// The UUID of the machine where the event(s) occurred. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string `protobuf:"bytes,2,opt,name=machine_id,proto3" json:"machine_id,omitempty"`
	// contains filtered or unexported fields
}

func (*EventUploadRequest) GetAuditEvents ¶ 

func (x *EventUploadRequest) GetAuditEvents() []*AuditEvent

func (*EventUploadRequest) GetEvents ¶ 

func (x *EventUploadRequest) GetEvents() []*Event

func (*EventUploadRequest) GetFileAccessEvents ¶ 

func (x *EventUploadRequest) GetFileAccessEvents() []*FileAccessEvent

func (*EventUploadRequest) GetMachineId ¶ 

func (x *EventUploadRequest) GetMachineId() string

func (*EventUploadRequest) ProtoMessage ¶ 

func (*EventUploadRequest) ProtoMessage()

func (*EventUploadRequest) ProtoReflect ¶ 

func (x *EventUploadRequest) ProtoReflect() protoreflect.Message

func (*EventUploadRequest) Reset ¶ 

func (x *EventUploadRequest) Reset()

func (*EventUploadRequest) SetAuditEvents ¶ 

func (x *EventUploadRequest) SetAuditEvents(v []*AuditEvent)

func (*EventUploadRequest) SetEvents ¶ 

func (x *EventUploadRequest) SetEvents(v []*Event)

func (*EventUploadRequest) SetFileAccessEvents ¶ 

func (x *EventUploadRequest) SetFileAccessEvents(v []*FileAccessEvent)

func (*EventUploadRequest) SetMachineId ¶ 

func (x *EventUploadRequest) SetMachineId(v string)

func (*EventUploadRequest) String ¶ 

func (x *EventUploadRequest) String() string

type EventUploadRequest_builder ¶ 

type EventUploadRequest_builder struct {

	// The set of execution events being uploaded.
	Events []*Event
	// A possible set of AuditEvents.
	AuditEvents []*AuditEvent
	// The set of FileAccess events being uploaded.
	FileAccessEvents []*FileAccessEvent
	// The UUID of the machine where the event(s) occurred. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string
	// contains filtered or unexported fields
}

func (EventUploadRequest_builder) Build ¶ 

func (b0 EventUploadRequest_builder) Build() *EventUploadRequest

type EventUploadResponse ¶ 

type EventUploadResponse struct {

	// If the EventUploadRequest contained any binaries in bundles that were
	// scanned and the server has not previously seen any of those bundles, this
	// field will contain the generated bundle hashes of those bundles. This will
	// trigger santasyncservice to uploaded BUNDLE_BINARY events for the binaries
	// that were discovered inside those bundles.
	EventUploadBundleBinaries []string `` /* 140-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*EventUploadResponse) GetEventUploadBundleBinaries ¶ 

func (x *EventUploadResponse) GetEventUploadBundleBinaries() []string

func (*EventUploadResponse) ProtoMessage ¶ 

func (*EventUploadResponse) ProtoMessage()

func (*EventUploadResponse) ProtoReflect ¶ 

func (x *EventUploadResponse) ProtoReflect() protoreflect.Message

func (*EventUploadResponse) Reset ¶ 

func (x *EventUploadResponse) Reset()

func (*EventUploadResponse) SetEventUploadBundleBinaries ¶ 

func (x *EventUploadResponse) SetEventUploadBundleBinaries(v []string)

func (*EventUploadResponse) String ¶ 

func (x *EventUploadResponse) String() string

type EventUploadResponse_builder ¶ 

type EventUploadResponse_builder struct {

	// If the EventUploadRequest contained any binaries in bundles that were
	// scanned and the server has not previously seen any of those bundles, this
	// field will contain the generated bundle hashes of those bundles. This will
	// trigger santasyncservice to uploaded BUNDLE_BINARY events for the binaries
	// that were discovered inside those bundles.
	EventUploadBundleBinaries []string
	// contains filtered or unexported fields
}

func (EventUploadResponse_builder) Build ¶ 

func (b0 EventUploadResponse_builder) Build() *EventUploadResponse

type Event_builder ¶ 

type Event_builder struct {

	// The SHA-256 of the binary file being executed.
	FileSha256 string
	// The path containing this binary, e.g. /usr/bin
	FilePath string
	// The name of the binary file, e.g. yes
	FileName string
	// The user that executed the binary.
	ExecutingUser string
	// The time of the execution, represented as the number of seconds since the
	// UNIX epoch. As a double-precision floating point number it can represent
	// submultiples in its fraction.
	ExecutionTime float64
	// The set of users logged in at the time of the execution.
	LoggedInUsers []string
	// The set of sessions at the time of execution.
	//
	//   - A user logged into the GUI will be shown as user@console
	//   - A user logged into a local terminal will be shown as user@ttyS000
	//   - A user logged in over SSH will be shown as user@IP
	CurrentSessions []string
	// The decision that was made. See the comments on the Decision enum for
	// interpreting this value.
	Decision Decision
	// If the executed file is part of a bundle, this field is the
	// CFBundleIdentifier, e.g. com.northpolesec.santa.
	FileBundleId string
	// If the executed file is part of a bundle, this field is the path of the
	// bundle. E.g. if the binary is at /Applications/Acme.app/Contents/MacOS/Acme
	// then the bundle path will be /Applications/Acme.app.
	FileBundlePath string
	// If the executed file is part of a bundle, this field is the path of the
	// executing binary relative to the root of the bundle. E.g. if the binary is
	// at /Applications/Acme.app/Contents/MacOS/Acme then this field will be
	// Contents/MacOS/Acme.
	FileBundleExecutableRelPath string
	// If the executed file is part of a bundle, this field will be the
	// CFBundleName of the bundle.
	FileBundleName string
	// If the executed file is part of a bundle, this field will be set to the
	// CFBundleVersion of the bundle.
	FileBundleVersion string
	// If the executed file is part of a bundle, this field will be set to the
	// CFBundleShortVersionString of the bundle.
	FileBundleVersionString string
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the calculated hash of the bundle.
	FileBundleHash string
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the number of milliseconds that
	// santabundleservice spend discovering all of the binaries inside the bundle
	// and hashing them to create the bundle hash.
	FileBundleHashMillis uint32
	// If the executed file is part of a bundle and bundle scanning is enabled,
	// this field will be set to the number of binaries that were discovered in
	// the bundle.
	FileBundleBinaryCount uint32
	// The pid of the execution (regardless of whether it was allowed or denied).
	Pid int32
	// The parent pid of the execution.
	Ppid int32
	// The name of the parent process.
	ParentName string
	// The team ID of the binary being executed.
	TeamId string
	// The signing ID of the binary being executed.
	// For binaries that are part of macOS this will be prefixed with platform:
	// For binaries that are signed by a valid developer certificate this will
	//
	//	be prefixed with the signer's team ID.
	SigningId string
	// The CDHash of the binary, if it is validly signed.
	Cdhash string
	// The URL that the executing binary was downloaded from, if the binary had
	// been quarantined at the time of download.
	// As of macOS 12, this data is usually not retrievable and this field will
	// not be populated, so it has been marked deprecated.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineDataUrl string
	// The referring URL that led to the URL the binary was downloaded from, if
	// the binary had been quarantined at the time of download.
	// As of macOS 12, this data is usually not retrievable and this field will
	// not be populated.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineRefererUrl string
	// Seconds since UNIX epoch. This field would ideally be an int64 but the
	// protobuf library encodes that as a string, unlike NSJSONSerialization.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineTimestamp uint32
	// If the binary was quarantined, this field contains the bundle ID of the
	// agent that downloaded the binary, e.g. com.google.Chrome.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	QuarantineAgentBundleId string
	// If the binary is properly signed, this field contains details of all of
	// the certificates in the signing chain, starting at the leaf certificate
	// (the one that directly signed the binary) leading up to a root.
	SigningChain []*Certificate
	// Entitlement information about the target executable.
	EntitlementInfo *EntitlementInfo
	// The raw codesigning flags set for the execution.
	CsFlags uint32
	// The signing status of the executing binary. This is calculated from the
	// cs_flags field but is generally easier to utilize.
	SigningStatus SigningStatus
	// The secure timestamp of when this binary was signed, as provided by the
	// timestamp service. Not populated for unsigned or ad-hoc signed binaries,
	// or if the secure timestamp is missing.
	// Number of seconds since UNIX epoch.
	SecureSigningTime uint32
	// The timestamp provided by the developer when this binary was signed.
	// It is possible for developers to set this to whatever they wish when signing
	// unlike the secure_signing_time.
	// Number of seconds since UNIX epoch.
	SigningTime uint32
	// This flag indicates that a StaticRule was applied to this event
	StaticRule bool
	// contains filtered or unexported fields
}

func (Event_builder) Build ¶ 

func (b0 Event_builder) Build() *Event

type ExportConfiguration ¶ 

type ExportConfiguration struct {

	// If additional configurations are added, wrap this and the new
	// configurations in a oneof.
	SignedPost *SignedPost `protobuf:"bytes,1,opt,name=signed_post,json=signedPost,proto3" json:"signed_post,omitempty"`
	// contains filtered or unexported fields
}

func (*ExportConfiguration) ClearSignedPost ¶ 

func (x *ExportConfiguration) ClearSignedPost()

func (*ExportConfiguration) GetSignedPost ¶ 

func (x *ExportConfiguration) GetSignedPost() *SignedPost

func (*ExportConfiguration) HasSignedPost ¶ 

func (x *ExportConfiguration) HasSignedPost() bool

func (*ExportConfiguration) ProtoMessage ¶ 

func (*ExportConfiguration) ProtoMessage()

func (*ExportConfiguration) ProtoReflect ¶ 

func (x *ExportConfiguration) ProtoReflect() protoreflect.Message

func (*ExportConfiguration) Reset ¶ 

func (x *ExportConfiguration) Reset()

func (*ExportConfiguration) SetSignedPost ¶ 

func (x *ExportConfiguration) SetSignedPost(v *SignedPost)

func (*ExportConfiguration) String ¶ 

func (x *ExportConfiguration) String() string

type ExportConfiguration_builder ¶ 

type ExportConfiguration_builder struct {

	// If additional configurations are added, wrap this and the new
	// configurations in a oneof.
	SignedPost *SignedPost
	// contains filtered or unexported fields
}

func (ExportConfiguration_builder) Build ¶ 

func (b0 ExportConfiguration_builder) Build() *ExportConfiguration

type FileAccessAction ¶ 

type FileAccessAction int32
const (
	// An unspecified FileAccessAction will fallback to not changing any settings on the host
	FileAccessAction_FILE_ACCESS_ACTION_UNSPECIFIED FileAccessAction = 0
	// The policy will be applied as written
	FileAccessAction_NONE FileAccessAction = 1
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileAccessAction_None FileAccessAction = 1
	// Actions that would be denied are logged but allowed
	FileAccessAction_AUDIT_ONLY FileAccessAction = 2
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileAccessAction_AuditOnly FileAccessAction = 2
	// No action will be taken
	FileAccessAction_DISABLE FileAccessAction = 3
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileAccessAction_Disable FileAccessAction = 3
)

func (FileAccessAction) Descriptor ¶ 

func (FileAccessAction) Descriptor() protoreflect.EnumDescriptor

func (FileAccessAction) Enum ¶ 

func (x FileAccessAction) Enum() *FileAccessAction

func (FileAccessAction) Number ¶ 

func (x FileAccessAction) Number() protoreflect.EnumNumber

func (FileAccessAction) String ¶ 

func (x FileAccessAction) String() string

func (FileAccessAction) Type ¶ 

func (FileAccessAction) Type() protoreflect.EnumType

type FileAccessDecision ¶ 

type FileAccessDecision int32

The FileAccessDecision enum records the decision Santa made about a file access operation. 

const (
	FileAccessDecision_FILE_ACCESS_DECISION_UNKNOWN FileAccessDecision = 0
	// The access operation was denied due to policy.
	FileAccessDecision_FILE_ACCESS_DECISION_DENIED FileAccessDecision = 1
	// The access was denied because the process's code signature was invalid.
	FileAccessDecision_FILE_ACCESS_DECISION_DENIED_INVALID_SIGNATURE FileAccessDecision = 2
	// The access was allowed, but recorded.
	FileAccessDecision_FILE_ACCESS_DECISION_AUDIT_ONLY FileAccessDecision = 3
)

func (FileAccessDecision) Descriptor ¶ 

func (FileAccessDecision) Descriptor() protoreflect.EnumDescriptor

func (FileAccessDecision) Enum ¶ 

func (x FileAccessDecision) Enum() *FileAccessDecision

func (FileAccessDecision) Number ¶ 

func (x FileAccessDecision) Number() protoreflect.EnumNumber

func (FileAccessDecision) String ¶ 

func (x FileAccessDecision) String() string

func (FileAccessDecision) Type ¶ 

func (FileAccessDecision) Type() protoreflect.EnumType

type FileAccessEvent ¶ 

type FileAccessEvent struct {

	// The version of the policy when the decision was made.
	RuleVersion string `protobuf:"bytes,1,opt,name=rule_version,proto3" json:"rule_version,omitempty"`
	// The name of the specific policy that triggered this log.
	RuleName string `protobuf:"bytes,2,opt,name=rule_name,proto3" json:"rule_name,omitempty"`
	// The path that was accessed.
	Target string `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
	// Information about the process chain that triggered this event.
	// The first process in the chain is the process that triggered this event,
	// each subsequent process is the parent of the previous process.
	ProcessChain []*Process `protobuf:"bytes,4,rep,name=process_chain,proto3" json:"process_chain,omitempty"`
	// The time of the access, represented as the number of seconds since the
	// UNIX epoch. As a double-precision floating point number it can represent
	// submultiples in its fraction.
	AccessTime float64 `protobuf:"fixed64,5,opt,name=access_time,proto3" json:"access_time,omitempty"`
	// The decision applied by Santa for this access operation.
	Decision FileAccessDecision `protobuf:"varint,6,opt,name=decision,proto3,enum=santa.sync.v1.FileAccessDecision" json:"decision,omitempty"`
	// contains filtered or unexported fields
}

Information related to an FAA policy violation.

func (*FileAccessEvent) GetAccessTime ¶ 

func (x *FileAccessEvent) GetAccessTime() float64

func (*FileAccessEvent) GetDecision ¶ 

func (x *FileAccessEvent) GetDecision() FileAccessDecision

func (*FileAccessEvent) GetProcessChain ¶ 

func (x *FileAccessEvent) GetProcessChain() []*Process

func (*FileAccessEvent) GetRuleName ¶ 

func (x *FileAccessEvent) GetRuleName() string

func (*FileAccessEvent) GetRuleVersion ¶ 

func (x *FileAccessEvent) GetRuleVersion() string

func (*FileAccessEvent) GetTarget ¶ 

func (x *FileAccessEvent) GetTarget() string

func (*FileAccessEvent) ProtoMessage ¶ 

func (*FileAccessEvent) ProtoMessage()

func (*FileAccessEvent) ProtoReflect ¶ 

func (x *FileAccessEvent) ProtoReflect() protoreflect.Message

func (*FileAccessEvent) Reset ¶ 

func (x *FileAccessEvent) Reset()

func (*FileAccessEvent) SetAccessTime ¶ 

func (x *FileAccessEvent) SetAccessTime(v float64)

func (*FileAccessEvent) SetDecision ¶ 

func (x *FileAccessEvent) SetDecision(v FileAccessDecision)

func (*FileAccessEvent) SetProcessChain ¶ 

func (x *FileAccessEvent) SetProcessChain(v []*Process)

func (*FileAccessEvent) SetRuleName ¶ 

func (x *FileAccessEvent) SetRuleName(v string)

func (*FileAccessEvent) SetRuleVersion ¶ 

func (x *FileAccessEvent) SetRuleVersion(v string)

func (*FileAccessEvent) SetTarget ¶ 

func (x *FileAccessEvent) SetTarget(v string)

func (*FileAccessEvent) String ¶ 

func (x *FileAccessEvent) String() string

type FileAccessEvent_builder ¶ 

type FileAccessEvent_builder struct {

	// The version of the policy when the decision was made.
	RuleVersion string
	// The name of the specific policy that triggered this log.
	RuleName string
	// The path that was accessed.
	Target string
	// Information about the process chain that triggered this event.
	// The first process in the chain is the process that triggered this event,
	// each subsequent process is the parent of the previous process.
	ProcessChain []*Process
	// The time of the access, represented as the number of seconds since the
	// UNIX epoch. As a double-precision floating point number it can represent
	// submultiples in its fraction.
	AccessTime float64
	// The decision applied by Santa for this access operation.
	Decision FileAccessDecision
	// contains filtered or unexported fields
}

func (FileAccessEvent_builder) Build ¶ 

func (b0 FileAccessEvent_builder) Build() *FileAccessEvent

type Policy ¶ 

type Policy int32

A policy for a given rule. 

const (
	// Should never be set, will be ignored.
	Policy_POLICY_UNKNOWN Policy = 0
	// The target should be allowed.
	Policy_ALLOWLIST Policy = 1
	// The target should be allowed and if the client has transitive allowlisting
	// enabled, any files created by this binary will be locally allowlisted.
	Policy_ALLOWLIST_COMPILER Policy = 2
	// The target should be blocked.
	Policy_BLOCKLIST Policy = 3
	// The target should be blocked and GUI notifications should not be shown to
	// the user. This should be used sparingly as the behavior of applications
	// being silently blocked can be very confusing for users. Combines
	// SILENT_GUI_BLOCKLIST and SILENT_TTY_BLOCKLIST: neither GUI nor TTY
	// notifications are shown.
	Policy_SILENT_BLOCKLIST Policy = 4
	// An existing rule for this target should be removed, allowing Santa to
	// fallback to rules with lower precedence or ultimately the client mode.
	Policy_REMOVE Policy = 5
	// The outcome of this rule will be determined by evaluating a CEL expression
	// attached to the rule. The expression will receive details about the binary
	// being executed and the context of the execution. The expression must return
	// either a santa.cel.v1.ReturnValue or a boolean, where true is equivalent to
	// ALLOWLIST and false is equivalent to BLOCKLIST.
	// See cel/v1.proto for more details.
	Policy_CEL Policy = 6
	// The target should be blocked and GUI notifications should not be shown to
	// the user, but TTY notifications should still be shown.
	Policy_SILENT_GUI_BLOCKLIST Policy = 8
	// The target should be blocked and TTY notifications should not be shown to
	// the user, but GUI notifications should still be shown.
	Policy_SILENT_TTY_BLOCKLIST Policy = 9
	// These enum values are deprecated and remain here for backward compatibility.
	Policy_WHITELIST          Policy = 1
	Policy_WHITELIST_COMPILER Policy = 2
	Policy_BLACKLIST          Policy = 3
	Policy_SILENT_BLACKLIST   Policy = 4
)

func (Policy) Descriptor ¶ 

func (Policy) Descriptor() protoreflect.EnumDescriptor

func (Policy) Enum ¶ 

func (x Policy) Enum() *Policy

func (Policy) Number ¶ 

func (x Policy) Number() protoreflect.EnumNumber

func (Policy) String ¶ 

func (x Policy) String() string

func (Policy) Type ¶ 

func (Policy) Type() protoreflect.EnumType

type PostflightRequest ¶ 

type PostflightRequest struct {

	// The total number of rules that were received by the client across all
	// RuleDownload requests.
	RulesReceived uint32 `protobuf:"varint,1,opt,name=rules_received,proto3" json:"rules_received,omitempty"`
	// The number of valid rules that were successfully imported.
	RulesProcessed uint32 `protobuf:"varint,2,opt,name=rules_processed,proto3" json:"rules_processed,omitempty"`
	// The UUID of the machine requesting rules. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string `protobuf:"bytes,3,opt,name=machine_id,proto3" json:"machine_id,omitempty"`
	// The type of sync that the client just completed. This is used to inform
	// the server whether a pending non-standard sync is still required.
	SyncType SyncType `protobuf:"varint,4,opt,name=sync_type,json=syncType,proto3,enum=santa.sync.v1.SyncType" json:"sync_type,omitempty"`
	// Hash of rules.
	RulesHash string `protobuf:"bytes,5,opt,name=rules_hash,json=rulesHash,proto3" json:"rules_hash,omitempty"`
	// contains filtered or unexported fields
}

func (*PostflightRequest) GetMachineId ¶ 

func (x *PostflightRequest) GetMachineId() string

func (*PostflightRequest) GetRulesHash ¶ 

func (x *PostflightRequest) GetRulesHash() string

func (*PostflightRequest) GetRulesProcessed ¶ 

func (x *PostflightRequest) GetRulesProcessed() uint32

func (*PostflightRequest) GetRulesReceived ¶ 

func (x *PostflightRequest) GetRulesReceived() uint32

func (*PostflightRequest) GetSyncType ¶ 

func (x *PostflightRequest) GetSyncType() SyncType

func (*PostflightRequest) ProtoMessage ¶ 

func (*PostflightRequest) ProtoMessage()

func (*PostflightRequest) ProtoReflect ¶ 

func (x *PostflightRequest) ProtoReflect() protoreflect.Message

func (*PostflightRequest) Reset ¶ 

func (x *PostflightRequest) Reset()

func (*PostflightRequest) SetMachineId ¶ 

func (x *PostflightRequest) SetMachineId(v string)

func (*PostflightRequest) SetRulesHash ¶ 

func (x *PostflightRequest) SetRulesHash(v string)

func (*PostflightRequest) SetRulesProcessed ¶ 

func (x *PostflightRequest) SetRulesProcessed(v uint32)

func (*PostflightRequest) SetRulesReceived ¶ 

func (x *PostflightRequest) SetRulesReceived(v uint32)

func (*PostflightRequest) SetSyncType ¶ 

func (x *PostflightRequest) SetSyncType(v SyncType)

func (*PostflightRequest) String ¶ 

func (x *PostflightRequest) String() string

type PostflightRequest_builder ¶ 

type PostflightRequest_builder struct {

	// The total number of rules that were received by the client across all
	// RuleDownload requests.
	RulesReceived uint32
	// The number of valid rules that were successfully imported.
	RulesProcessed uint32
	// The UUID of the machine requesting rules. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string
	// The type of sync that the client just completed. This is used to inform
	// the server whether a pending non-standard sync is still required.
	SyncType SyncType
	// Hash of rules.
	RulesHash string
	// contains filtered or unexported fields
}

func (PostflightRequest_builder) Build ¶ 

func (b0 PostflightRequest_builder) Build() *PostflightRequest

type PostflightResponse ¶ 

type PostflightResponse struct {
	// contains filtered or unexported fields
}

func (*PostflightResponse) ProtoMessage ¶ 

func (*PostflightResponse) ProtoMessage()

func (*PostflightResponse) ProtoReflect ¶ 

func (x *PostflightResponse) ProtoReflect() protoreflect.Message

func (*PostflightResponse) Reset ¶ 

func (x *PostflightResponse) Reset()

func (*PostflightResponse) String ¶ 

func (x *PostflightResponse) String() string

type PostflightResponse_builder ¶ 

type PostflightResponse_builder struct {
	// contains filtered or unexported fields
}

func (PostflightResponse_builder) Build ¶ 

func (b0 PostflightResponse_builder) Build() *PostflightResponse

type PreflightRequest ¶ 

type PreflightRequest struct {

	// The host's serial number.
	SerialNumber string `protobuf:"bytes,1,opt,name=serial_number,json=serial_num,proto3" json:"serial_number,omitempty"`
	// The fully-qualified domain name, as returned by
	// the gethostname() call.
	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
	// The macOS version as reported in
	// `/System/Library/CoreServices/SystemVersion.plist`
	OsVersion string `protobuf:"bytes,3,opt,name=os_version,proto3" json:"os_version,omitempty"`
	// The macOS build number as reported in
	// `/System/Library/CoreServices/SystemVersion.plist`
	OsBuild string `protobuf:"bytes,4,opt,name=os_build,proto3" json:"os_build,omitempty"`
	// The host's model identifier, such as MacPro4,1 or Mac15,7, as reported
	// by `sysctl hw.model`
	ModelIdentifier string `protobuf:"bytes,5,opt,name=model_identifier,proto3" json:"model_identifier,omitempty"`
	// The version of Santa making this request, e.g. 2025.1.80
	SantaVersion string `protobuf:"bytes,6,opt,name=santa_version,proto3" json:"santa_version,omitempty"`
	// The primary user of this machine, as configured by either the `MachineOwner`
	// or (`MachineOwnerPlist` and `MachineOwnerKey`) configuration options.
	PrimaryUser string `protobuf:"bytes,7,opt,name=primary_user,proto3" json:"primary_user,omitempty"`
	// Groups the primary user of this machine should be associated with on the
	// sync server. Configured by either the `MachineOwnerGroups` or
	// (`MachineOwnerPlist` and `MachineOwnerGroupsKey`) configuration options.
	PrimaryUserGroups []string `protobuf:"bytes,21,rep,name=primary_user_groups,proto3" json:"primary_user_groups,omitempty"`
	// If FCM or APNS push notifications are enabled, this will contain the
	// notification token required to send push notifications back to this host.
	PushNotificationToken string `protobuf:"bytes,8,opt,name=push_notification_token,proto3" json:"push_notification_token,omitempty"`
	// The client mode that the machine is running in at the time of this sync.
	ClientMode ClientMode `protobuf:"varint,9,opt,name=client_mode,proto3,enum=santa.sync.v1.ClientMode" json:"client_mode,omitempty"`
	// True, if the user (or Santa itself) requested a clean sync.
	// The user can request this by running `santactl sync --clean`. Santa itself
	// can also request a clean sync if the database is re-initialized or the
	// SyncBaseURL changes.
	RequestCleanSync bool `protobuf:"varint,10,opt,name=request_clean_sync,proto3" json:"request_clean_sync,omitempty"`
	// The number of BINARY rules in the database.
	BinaryRuleCount uint32 `protobuf:"varint,11,opt,name=binary_rule_count,proto3" json:"binary_rule_count,omitempty"`
	// The number of CERTIFICATE rules in the database.
	CertificateRuleCount uint32 `protobuf:"varint,12,opt,name=certificate_rule_count,proto3" json:"certificate_rule_count,omitempty"`
	// The number of ALLOW_COMPILER rules in the database.
	CompilerRuleCount uint32 `protobuf:"varint,13,opt,name=compiler_rule_count,proto3" json:"compiler_rule_count,omitempty"`
	// The number of rules that have been created by an allowed compiler.
	TransitiveRuleCount uint32 `protobuf:"varint,14,opt,name=transitive_rule_count,proto3" json:"transitive_rule_count,omitempty"`
	// The number of TEAMID rules in the database.
	TeamidRuleCount uint32 `protobuf:"varint,15,opt,name=teamid_rule_count,proto3" json:"teamid_rule_count,omitempty"`
	// The number of SIGNINGID rules in the database.
	SigningidRuleCount uint32 `protobuf:"varint,16,opt,name=signingid_rule_count,proto3" json:"signingid_rule_count,omitempty"`
	// The number of CDHASH rules in the database.
	CdhashRuleCount uint32 `protobuf:"varint,17,opt,name=cdhash_rule_count,proto3" json:"cdhash_rule_count,omitempty"`
	// The UUID of the machine that is sending this preflight.
	// This will always match the UUID included in the request URL.
	// This ID will be the first non-empty value of:
	//  1. The value configured in the `MachineID` key in the config profile.
	//  2. The value read from the `MachineIDKey` key from the `MachineIDPlist` plist.
	//  3. The machine's hardware UUID.
	MachineId string `protobuf:"bytes,18,opt,name=machine_id,proto3" json:"machine_id,omitempty"`
	// True, if the sync is a result of a push notification.
	PushNotificationSync bool `protobuf:"varint,19,opt,name=push_notification_sync,proto3" json:"push_notification_sync,omitempty"`
	// The SIP status of this host at the time this preflight was performed. If
	// Santa is able to retrieve the value, this field will be populated with the
	// raw CSR config flags.
	SipStatus uint32 `protobuf:"varint,20,opt,name=sip_status,json=sipStatus,proto3" json:"sip_status,omitempty"`
	// Hash of rules.
	RulesHash string `protobuf:"bytes,22,opt,name=rules_hash,json=rulesHash,proto3" json:"rules_hash,omitempty"`
	// contains filtered or unexported fields
}

func (*PreflightRequest) GetBinaryRuleCount ¶ 

func (x *PreflightRequest) GetBinaryRuleCount() uint32

func (*PreflightRequest) GetCdhashRuleCount ¶ 

func (x *PreflightRequest) GetCdhashRuleCount() uint32

func (*PreflightRequest) GetCertificateRuleCount ¶ 

func (x *PreflightRequest) GetCertificateRuleCount() uint32

func (*PreflightRequest) GetClientMode ¶ 

func (x *PreflightRequest) GetClientMode() ClientMode

func (*PreflightRequest) GetCompilerRuleCount ¶ 

func (x *PreflightRequest) GetCompilerRuleCount() uint32

func (*PreflightRequest) GetHostname ¶ 

func (x *PreflightRequest) GetHostname() string

func (*PreflightRequest) GetMachineId ¶ 

func (x *PreflightRequest) GetMachineId() string

func (*PreflightRequest) GetModelIdentifier ¶ 

func (x *PreflightRequest) GetModelIdentifier() string

func (*PreflightRequest) GetOsBuild ¶ 

func (x *PreflightRequest) GetOsBuild() string

func (*PreflightRequest) GetOsVersion ¶ 

func (x *PreflightRequest) GetOsVersion() string

func (*PreflightRequest) GetPrimaryUser ¶ 

func (x *PreflightRequest) GetPrimaryUser() string

func (*PreflightRequest) GetPrimaryUserGroups ¶ 

func (x *PreflightRequest) GetPrimaryUserGroups() []string

func (*PreflightRequest) GetPushNotificationSync ¶ 

func (x *PreflightRequest) GetPushNotificationSync() bool

func (*PreflightRequest) GetPushNotificationToken ¶ 

func (x *PreflightRequest) GetPushNotificationToken() string

func (*PreflightRequest) GetRequestCleanSync ¶ 

func (x *PreflightRequest) GetRequestCleanSync() bool

func (*PreflightRequest) GetRulesHash ¶ 

func (x *PreflightRequest) GetRulesHash() string

func (*PreflightRequest) GetSantaVersion ¶ 

func (x *PreflightRequest) GetSantaVersion() string

func (*PreflightRequest) GetSerialNumber ¶ 

func (x *PreflightRequest) GetSerialNumber() string

func (*PreflightRequest) GetSigningidRuleCount ¶ 

func (x *PreflightRequest) GetSigningidRuleCount() uint32

func (*PreflightRequest) GetSipStatus ¶ 

func (x *PreflightRequest) GetSipStatus() uint32

func (*PreflightRequest) GetTeamidRuleCount ¶ 

func (x *PreflightRequest) GetTeamidRuleCount() uint32

func (*PreflightRequest) GetTransitiveRuleCount ¶ 

func (x *PreflightRequest) GetTransitiveRuleCount() uint32

func (*PreflightRequest) ProtoMessage ¶ 

func (*PreflightRequest) ProtoMessage()

func (*PreflightRequest) ProtoReflect ¶ 

func (x *PreflightRequest) ProtoReflect() protoreflect.Message

func (*PreflightRequest) Reset ¶ 

func (x *PreflightRequest) Reset()

func (*PreflightRequest) SetBinaryRuleCount ¶ 

func (x *PreflightRequest) SetBinaryRuleCount(v uint32)

func (*PreflightRequest) SetCdhashRuleCount ¶ 

func (x *PreflightRequest) SetCdhashRuleCount(v uint32)

func (*PreflightRequest) SetCertificateRuleCount ¶ 

func (x *PreflightRequest) SetCertificateRuleCount(v uint32)

func (*PreflightRequest) SetClientMode ¶ 

func (x *PreflightRequest) SetClientMode(v ClientMode)

func (*PreflightRequest) SetCompilerRuleCount ¶ 

func (x *PreflightRequest) SetCompilerRuleCount(v uint32)

func (*PreflightRequest) SetHostname ¶ 

func (x *PreflightRequest) SetHostname(v string)

func (*PreflightRequest) SetMachineId ¶ 

func (x *PreflightRequest) SetMachineId(v string)

func (*PreflightRequest) SetModelIdentifier ¶ 

func (x *PreflightRequest) SetModelIdentifier(v string)

func (*PreflightRequest) SetOsBuild ¶ 

func (x *PreflightRequest) SetOsBuild(v string)

func (*PreflightRequest) SetOsVersion ¶ 

func (x *PreflightRequest) SetOsVersion(v string)

func (*PreflightRequest) SetPrimaryUser ¶ 

func (x *PreflightRequest) SetPrimaryUser(v string)

func (*PreflightRequest) SetPrimaryUserGroups ¶ 

func (x *PreflightRequest) SetPrimaryUserGroups(v []string)

func (*PreflightRequest) SetPushNotificationSync ¶ 

func (x *PreflightRequest) SetPushNotificationSync(v bool)

func (*PreflightRequest) SetPushNotificationToken ¶ 

func (x *PreflightRequest) SetPushNotificationToken(v string)

func (*PreflightRequest) SetRequestCleanSync ¶ 

func (x *PreflightRequest) SetRequestCleanSync(v bool)

func (*PreflightRequest) SetRulesHash ¶ 

func (x *PreflightRequest) SetRulesHash(v string)

func (*PreflightRequest) SetSantaVersion ¶ 

func (x *PreflightRequest) SetSantaVersion(v string)

func (*PreflightRequest) SetSerialNumber ¶ 

func (x *PreflightRequest) SetSerialNumber(v string)

func (*PreflightRequest) SetSigningidRuleCount ¶ 

func (x *PreflightRequest) SetSigningidRuleCount(v uint32)

func (*PreflightRequest) SetSipStatus ¶ 

func (x *PreflightRequest) SetSipStatus(v uint32)

func (*PreflightRequest) SetTeamidRuleCount ¶ 

func (x *PreflightRequest) SetTeamidRuleCount(v uint32)

func (*PreflightRequest) SetTransitiveRuleCount ¶ 

func (x *PreflightRequest) SetTransitiveRuleCount(v uint32)

func (*PreflightRequest) String ¶ 

func (x *PreflightRequest) String() string

type PreflightRequest_builder ¶ 

type PreflightRequest_builder struct {

	// The host's serial number.
	SerialNumber string
	// The fully-qualified domain name, as returned by
	// the gethostname() call.
	Hostname string
	// The macOS version as reported in
	// `/System/Library/CoreServices/SystemVersion.plist`
	OsVersion string
	// The macOS build number as reported in
	// `/System/Library/CoreServices/SystemVersion.plist`
	OsBuild string
	// The host's model identifier, such as MacPro4,1 or Mac15,7, as reported
	// by `sysctl hw.model`
	ModelIdentifier string
	// The version of Santa making this request, e.g. 2025.1.80
	SantaVersion string
	// The primary user of this machine, as configured by either the `MachineOwner`
	// or (`MachineOwnerPlist` and `MachineOwnerKey`) configuration options.
	PrimaryUser string
	// Groups the primary user of this machine should be associated with on the
	// sync server. Configured by either the `MachineOwnerGroups` or
	// (`MachineOwnerPlist` and `MachineOwnerGroupsKey`) configuration options.
	PrimaryUserGroups []string
	// If FCM or APNS push notifications are enabled, this will contain the
	// notification token required to send push notifications back to this host.
	PushNotificationToken string
	// The client mode that the machine is running in at the time of this sync.
	ClientMode ClientMode
	// True, if the user (or Santa itself) requested a clean sync.
	// The user can request this by running `santactl sync --clean`. Santa itself
	// can also request a clean sync if the database is re-initialized or the
	// SyncBaseURL changes.
	RequestCleanSync bool
	// The number of BINARY rules in the database.
	BinaryRuleCount uint32
	// The number of CERTIFICATE rules in the database.
	CertificateRuleCount uint32
	// The number of ALLOW_COMPILER rules in the database.
	CompilerRuleCount uint32
	// The number of rules that have been created by an allowed compiler.
	TransitiveRuleCount uint32
	// The number of TEAMID rules in the database.
	TeamidRuleCount uint32
	// The number of SIGNINGID rules in the database.
	SigningidRuleCount uint32
	// The number of CDHASH rules in the database.
	CdhashRuleCount uint32
	// The UUID of the machine that is sending this preflight.
	// This will always match the UUID included in the request URL.
	// This ID will be the first non-empty value of:
	//  1. The value configured in the `MachineID` key in the config profile.
	//  2. The value read from the `MachineIDKey` key from the `MachineIDPlist` plist.
	//  3. The machine's hardware UUID.
	MachineId string
	// True, if the sync is a result of a push notification.
	PushNotificationSync bool
	// The SIP status of this host at the time this preflight was performed. If
	// Santa is able to retrieve the value, this field will be populated with the
	// raw CSR config flags.
	SipStatus uint32
	// Hash of rules.
	RulesHash string
	// contains filtered or unexported fields
}

func (PreflightRequest_builder) Build ¶ 

func (b0 PreflightRequest_builder) Build() *PreflightRequest

type PreflightResponse ¶ 

type PreflightResponse struct {

	// The client mode that the client should move into at the end of this sync.
	// The mode does not change until the Postflight request has been made, to
	// ensure the client has received all the needed rules before potentially
	// going into Lockdown.
	ClientMode ClientMode `protobuf:"varint,1,opt,name=client_mode,json=clientMode,proto3,enum=santa.sync.v1.ClientMode" json:"client_mode,omitempty"`
	// The SyncType of this sync, which impacts how rules are applied. See the
	// comments on the `SyncType` enum to learn how Santa interprets this value.
	SyncType *SyncType `protobuf:"varint,2,opt,name=sync_type,json=syncType,proto3,enum=santa.sync.v1.SyncType,oneof" json:"sync_type,omitempty"`
	// Controls how many events Santa should upload in a single EventUpload request.
	// If the server doesn't specify, the default is 50.
	BatchSize uint32 `protobuf:"varint,3,opt,name=batch_size,json=batchSize,proto3" json:"batch_size,omitempty"`
	// Enable bundle hashing and bundle rules. If this is enabled when a binary
	// is blocked Santa will try to determine the outermost bundle that it is a
	// part of and create a "bundle hash" for the whole bundle. When the sync
	// server receives this bundle hash it can decide whether to request that
	// Santa uploads more details about all of the binaries contained within the
	// bundle.
	EnableBundles *bool `protobuf:"varint,4,opt,name=enable_bundles,json=enableBundles,proto3,oneof" json:"enable_bundles,omitempty"`
	// Enable transitive (ALLOWLIST_COMPILER) rules.
	// Without this enabled, any received ALLOWLIST_COMPILER rules will be treated
	// as ALLOWLIST.
	EnableTransitiveRules *bool `` /* 133-byte string literal not displayed */
	// Ordinarily, Santa will only upload events about executions that are denied
	// or would be denied if the machine were in LOCKDOWN mode. With this enabled,
	// Santa will upload details about all events. It is important to note that
	// due to caching, not every execution will be logged, only those that require
	// Santa to make a decision. If you want information about every single
	// execution, with much more fidelity than is available from Events,
	// Santa can record telemetry by configuring the Telemetry, EventLogType, and
	// EventLogPath keys in the configuration profile.
	EnableAllEventUpload *bool `` /* 132-byte string literal not displayed */
	// Ordinarily, Santa will only upload events about executions that are denied
	// or would be denied if the machine were in LOCKDOWN mode. With this enabled,
	// Santa will NOT upload events for binaries that would have been blocked in LOCKDOWN.
	DisableUnknownEventUpload *bool `` /* 147-byte string literal not displayed */
	// Specifies the time interval in seconds between full syncs.
	// Defaults to 600 (10 minutes). Cannot be set lower than 60.
	FullSyncIntervalSeconds uint32 `` /* 130-byte string literal not displayed */
	// When push notifications are enabled, this overrides the full_sync_interval
	// above. It is expected that Santa will not need to perform a full sync as
	// frequently when push notifications are working.
	// Defaults to 14400 (4 hours).
	PushNotificationFullSyncIntervalSeconds uint32 `` /* 184-byte string literal not displayed */
	// The maximum number of seconds Santa can wait before triggering a rule sync
	// after receiving a "global rule sync" notification. As these notifications
	// cause every Santa client to try and sync, we add a random delay to each
	// client to try and spread the load out on the sync server.
	// Defaults to 600 (10 minutes).
	PushNotificationGlobalRuleSyncDeadlineSeconds uint32 `` /* 206-byte string literal not displayed */
	// A regex, in ICU format, that if an execution from a path matches the regex
	// and the execution has not already matched any other rules, will cause the
	// execution to be allowed. While this feature can be useful, its use should
	// be very carefully considered as it is much riskier than real rules.
	// N.b: `blocked_path_regex` is applied before `allowed_path_regex`, if both
	// are configured.
	AllowedPathRegex *string `protobuf:"bytes,11,opt,name=allowed_path_regex,json=allowedPathRegex,proto3,oneof" json:"allowed_path_regex,omitempty"`
	// A regex, in ICU format, that if an execution from a path matches the regex
	// and the execution has not already matched any other rules, will cause the
	// execution to be blocked. While this feature can be useful, its use should
	// be very carefully considered as it is much riskier than real rules.
	BlockedPathRegex *string `protobuf:"bytes,12,opt,name=blocked_path_regex,json=blockedPathRegex,proto3,oneof" json:"blocked_path_regex,omitempty"`
	// Deprecated: use `removable_media_mount_control` instead.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	BlockUsbMount *bool `protobuf:"varint,13,opt,name=block_usb_mount,json=blockUsbMount,proto3,oneof" json:"block_usb_mount,omitempty"`
	// Baseline policy for all removable media.
	// If unset, falls back to deprecated `block_usb_mount` + `remount_usb_mode`.
	RemovableMediaPolicy *RemovableMediaPolicy `` /* 130-byte string literal not displayed */
	// Optional override for encrypted volumes.
	// If unset, encrypted volumes use `removable_media_policy`.
	EncryptedRemovableMediaPolicy *RemovableMediaPolicy `` /* 159-byte string literal not displayed */
	// If set, if a mount of a USB device happens and the mount flags match, the
	// mount will be allowed. If the flags do not match, Santa will deny the mount
	// but then remount with the provided flags.
	// `remount_usb_mode` is deprecated. Use removable_media_policy instead.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	RemountUsbMode []string `protobuf:"bytes,14,rep,name=remount_usb_mode,json=remountUsbMode,proto3" json:"remount_usb_mode,omitempty"`
	// Overrides the File Access Authorization (FAA) policy to change the performed action.
	// Allowed values:
	//
	//	`disable`: No action will be taken
	//	`auditonly`: Actions that would be denied are logged but allowed
	//	`none`: The policy will be applied as written
	OverrideFileAccessAction *FileAccessAction `` /* 181-byte string literal not displayed */
	// If set, contains the configuration Santa needs to export data to the
	// configured destination.
	ExportConfiguration *ExportConfiguration `protobuf:"bytes,16,opt,name=export_configuration,json=exportConfiguration,proto3,oneof" json:"export_configuration,omitempty"`
	// The signed JWT push token chain used to upgrade sync v1 connections to sync
	// v2.
	PushToken       string `protobuf:"bytes,21,opt,name=push_token,json=pushToken,proto3" json:"push_token,omitempty"`
	PushIssuerToken string `protobuf:"bytes,33,opt,name=push_issuer_token,json=pushIssuerToken,proto3" json:"push_issuer_token,omitempty"`
	// The URL to open when the user clicks the button on a block notification.
	// This URL will be used for all rules unless overridden by a rule-specific
	// option. This property supports several placeholders in the string that
	// will be replaced before the URL is constructed. Refer to Santa
	// documentation for a complete list of supported placeholders.
	EventDetailUrl *string `protobuf:"bytes,26,opt,name=event_detail_url,json=eventDetailUrl,proto3,oneof" json:"event_detail_url,omitempty"`
	// Related to the event_detail_url, this string represents the text to show
	// on the button of the block notification show to a user.
	EventDetailText *string `protobuf:"bytes,27,opt,name=event_detail_text,json=eventDetailText,proto3,oneof" json:"event_detail_text,omitempty"`
	// These fields are deprecated forms of other fields and exist here solely for
	// backwards compatibility.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedEnabledTransitiveWhitelisting *bool `` /* 184-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedTransitiveWhitelistingEnabled *bool `` /* 184-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedBundlesEnabled *bool `` /* 136-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedFcmFullSyncIntervalSeconds *uint32 `` /* 173-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedFcmGlobalRuleSyncDeadlineSeconds *uint32 `` /* 194-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedWhitelistRegex *string `` /* 135-byte string literal not displayed */
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedBlacklistRegex *string `` /* 135-byte string literal not displayed */
	// Deprecated but still supported key that acts like sync_type was set to
	// "CLEAN" unless the client had requested a clean sync, in which case it acts
	// like "CLEAN_ALL"
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedCleanSync *bool `protobuf:"varint,1007,opt,name=deprecated_clean_sync,json=clean_sync,proto3,oneof" json:"deprecated_clean_sync,omitempty"`
	// contains filtered or unexported fields
}

func (*PreflightResponse) ClearAllowedPathRegex ¶ 

func (x *PreflightResponse) ClearAllowedPathRegex()

func (*PreflightResponse) ClearBlockUsbMount deprecated 

func (x *PreflightResponse) ClearBlockUsbMount()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearBlockedPathRegex ¶ 

func (x *PreflightResponse) ClearBlockedPathRegex()

func (*PreflightResponse) ClearDeprecatedBlacklistRegex deprecated 

func (x *PreflightResponse) ClearDeprecatedBlacklistRegex()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedBundlesEnabled deprecated 

func (x *PreflightResponse) ClearDeprecatedBundlesEnabled()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedCleanSync deprecated 

func (x *PreflightResponse) ClearDeprecatedCleanSync()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedEnabledTransitiveWhitelisting deprecated 

func (x *PreflightResponse) ClearDeprecatedEnabledTransitiveWhitelisting()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedFcmFullSyncIntervalSeconds deprecated 

func (x *PreflightResponse) ClearDeprecatedFcmFullSyncIntervalSeconds()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedFcmGlobalRuleSyncDeadlineSeconds deprecated 

func (x *PreflightResponse) ClearDeprecatedFcmGlobalRuleSyncDeadlineSeconds()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedTransitiveWhitelistingEnabled deprecated 

func (x *PreflightResponse) ClearDeprecatedTransitiveWhitelistingEnabled()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDeprecatedWhitelistRegex deprecated 

func (x *PreflightResponse) ClearDeprecatedWhitelistRegex()

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) ClearDisableUnknownEventUpload ¶ 

func (x *PreflightResponse) ClearDisableUnknownEventUpload()

func (*PreflightResponse) ClearEnableAllEventUpload ¶ 

func (x *PreflightResponse) ClearEnableAllEventUpload()

func (*PreflightResponse) ClearEnableBundles ¶ 

func (x *PreflightResponse) ClearEnableBundles()

func (*PreflightResponse) ClearEnableTransitiveRules ¶ 

func (x *PreflightResponse) ClearEnableTransitiveRules()

func (*PreflightResponse) ClearEncryptedRemovableMediaPolicy ¶ 

func (x *PreflightResponse) ClearEncryptedRemovableMediaPolicy()

func (*PreflightResponse) ClearEventDetailText ¶ 

func (x *PreflightResponse) ClearEventDetailText()

func (*PreflightResponse) ClearEventDetailUrl ¶ 

func (x *PreflightResponse) ClearEventDetailUrl()

func (*PreflightResponse) ClearExportConfiguration ¶ 

func (x *PreflightResponse) ClearExportConfiguration()

func (*PreflightResponse) ClearOverrideFileAccessAction ¶ 

func (x *PreflightResponse) ClearOverrideFileAccessAction()

func (*PreflightResponse) ClearRemovableMediaPolicy ¶ 

func (x *PreflightResponse) ClearRemovableMediaPolicy()

func (*PreflightResponse) ClearSyncType ¶ 

func (x *PreflightResponse) ClearSyncType()

func (*PreflightResponse) GetAllowedPathRegex ¶ 

func (x *PreflightResponse) GetAllowedPathRegex() string

func (*PreflightResponse) GetBatchSize ¶ 

func (x *PreflightResponse) GetBatchSize() uint32

func (*PreflightResponse) GetBlockUsbMount deprecated 

func (x *PreflightResponse) GetBlockUsbMount() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetBlockedPathRegex ¶ 

func (x *PreflightResponse) GetBlockedPathRegex() string

func (*PreflightResponse) GetClientMode ¶ 

func (x *PreflightResponse) GetClientMode() ClientMode

func (*PreflightResponse) GetDeprecatedBlacklistRegex deprecated 

func (x *PreflightResponse) GetDeprecatedBlacklistRegex() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedBundlesEnabled deprecated 

func (x *PreflightResponse) GetDeprecatedBundlesEnabled() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedCleanSync deprecated 

func (x *PreflightResponse) GetDeprecatedCleanSync() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedEnabledTransitiveWhitelisting deprecated 

func (x *PreflightResponse) GetDeprecatedEnabledTransitiveWhitelisting() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedFcmFullSyncIntervalSeconds deprecated 

func (x *PreflightResponse) GetDeprecatedFcmFullSyncIntervalSeconds() uint32

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedFcmGlobalRuleSyncDeadlineSeconds deprecated 

func (x *PreflightResponse) GetDeprecatedFcmGlobalRuleSyncDeadlineSeconds() uint32

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedTransitiveWhitelistingEnabled deprecated 

func (x *PreflightResponse) GetDeprecatedTransitiveWhitelistingEnabled() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDeprecatedWhitelistRegex deprecated 

func (x *PreflightResponse) GetDeprecatedWhitelistRegex() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetDisableUnknownEventUpload ¶ 

func (x *PreflightResponse) GetDisableUnknownEventUpload() bool

func (*PreflightResponse) GetEnableAllEventUpload ¶ 

func (x *PreflightResponse) GetEnableAllEventUpload() bool

func (*PreflightResponse) GetEnableBundles ¶ 

func (x *PreflightResponse) GetEnableBundles() bool

func (*PreflightResponse) GetEnableTransitiveRules ¶ 

func (x *PreflightResponse) GetEnableTransitiveRules() bool

func (*PreflightResponse) GetEncryptedRemovableMediaPolicy ¶ 

func (x *PreflightResponse) GetEncryptedRemovableMediaPolicy() *RemovableMediaPolicy

func (*PreflightResponse) GetEventDetailText ¶ 

func (x *PreflightResponse) GetEventDetailText() string

func (*PreflightResponse) GetEventDetailUrl ¶ 

func (x *PreflightResponse) GetEventDetailUrl() string

func (*PreflightResponse) GetExportConfiguration ¶ 

func (x *PreflightResponse) GetExportConfiguration() *ExportConfiguration

func (*PreflightResponse) GetFullSyncIntervalSeconds ¶ 

func (x *PreflightResponse) GetFullSyncIntervalSeconds() uint32

func (*PreflightResponse) GetOverrideFileAccessAction ¶ 

func (x *PreflightResponse) GetOverrideFileAccessAction() FileAccessAction

func (*PreflightResponse) GetPushIssuerToken ¶ 

func (x *PreflightResponse) GetPushIssuerToken() string

func (*PreflightResponse) GetPushNotificationFullSyncIntervalSeconds ¶ 

func (x *PreflightResponse) GetPushNotificationFullSyncIntervalSeconds() uint32

func (*PreflightResponse) GetPushNotificationGlobalRuleSyncDeadlineSeconds ¶ 

func (x *PreflightResponse) GetPushNotificationGlobalRuleSyncDeadlineSeconds() uint32

func (*PreflightResponse) GetPushToken ¶ 

func (x *PreflightResponse) GetPushToken() string

func (*PreflightResponse) GetRemountUsbMode deprecated 

func (x *PreflightResponse) GetRemountUsbMode() []string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) GetRemovableMediaPolicy ¶ 

func (x *PreflightResponse) GetRemovableMediaPolicy() *RemovableMediaPolicy

func (*PreflightResponse) GetSyncType ¶ 

func (x *PreflightResponse) GetSyncType() SyncType

func (*PreflightResponse) HasAllowedPathRegex ¶ 

func (x *PreflightResponse) HasAllowedPathRegex() bool

func (*PreflightResponse) HasBlockUsbMount deprecated 

func (x *PreflightResponse) HasBlockUsbMount() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasBlockedPathRegex ¶ 

func (x *PreflightResponse) HasBlockedPathRegex() bool

func (*PreflightResponse) HasDeprecatedBlacklistRegex deprecated 

func (x *PreflightResponse) HasDeprecatedBlacklistRegex() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedBundlesEnabled deprecated 

func (x *PreflightResponse) HasDeprecatedBundlesEnabled() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedCleanSync deprecated 

func (x *PreflightResponse) HasDeprecatedCleanSync() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedEnabledTransitiveWhitelisting deprecated 

func (x *PreflightResponse) HasDeprecatedEnabledTransitiveWhitelisting() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedFcmFullSyncIntervalSeconds deprecated 

func (x *PreflightResponse) HasDeprecatedFcmFullSyncIntervalSeconds() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedFcmGlobalRuleSyncDeadlineSeconds deprecated 

func (x *PreflightResponse) HasDeprecatedFcmGlobalRuleSyncDeadlineSeconds() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedTransitiveWhitelistingEnabled deprecated 

func (x *PreflightResponse) HasDeprecatedTransitiveWhitelistingEnabled() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDeprecatedWhitelistRegex deprecated 

func (x *PreflightResponse) HasDeprecatedWhitelistRegex() bool

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) HasDisableUnknownEventUpload ¶ 

func (x *PreflightResponse) HasDisableUnknownEventUpload() bool

func (*PreflightResponse) HasEnableAllEventUpload ¶ 

func (x *PreflightResponse) HasEnableAllEventUpload() bool

func (*PreflightResponse) HasEnableBundles ¶ 

func (x *PreflightResponse) HasEnableBundles() bool

func (*PreflightResponse) HasEnableTransitiveRules ¶ 

func (x *PreflightResponse) HasEnableTransitiveRules() bool

func (*PreflightResponse) HasEncryptedRemovableMediaPolicy ¶ 

func (x *PreflightResponse) HasEncryptedRemovableMediaPolicy() bool

func (*PreflightResponse) HasEventDetailText ¶ 

func (x *PreflightResponse) HasEventDetailText() bool

func (*PreflightResponse) HasEventDetailUrl ¶ 

func (x *PreflightResponse) HasEventDetailUrl() bool

func (*PreflightResponse) HasExportConfiguration ¶ 

func (x *PreflightResponse) HasExportConfiguration() bool

func (*PreflightResponse) HasOverrideFileAccessAction ¶ 

func (x *PreflightResponse) HasOverrideFileAccessAction() bool

func (*PreflightResponse) HasRemovableMediaPolicy ¶ 

func (x *PreflightResponse) HasRemovableMediaPolicy() bool

func (*PreflightResponse) HasSyncType ¶ 

func (x *PreflightResponse) HasSyncType() bool

func (*PreflightResponse) ProtoMessage ¶ 

func (*PreflightResponse) ProtoMessage()

func (*PreflightResponse) ProtoReflect ¶ 

func (x *PreflightResponse) ProtoReflect() protoreflect.Message

func (*PreflightResponse) Reset ¶ 

func (x *PreflightResponse) Reset()

func (*PreflightResponse) SetAllowedPathRegex ¶ 

func (x *PreflightResponse) SetAllowedPathRegex(v string)

func (*PreflightResponse) SetBatchSize ¶ 

func (x *PreflightResponse) SetBatchSize(v uint32)

func (*PreflightResponse) SetBlockUsbMount deprecated 

func (x *PreflightResponse) SetBlockUsbMount(v bool)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetBlockedPathRegex ¶ 

func (x *PreflightResponse) SetBlockedPathRegex(v string)

func (*PreflightResponse) SetClientMode ¶ 

func (x *PreflightResponse) SetClientMode(v ClientMode)

func (*PreflightResponse) SetDeprecatedBlacklistRegex deprecated 

func (x *PreflightResponse) SetDeprecatedBlacklistRegex(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedBundlesEnabled deprecated 

func (x *PreflightResponse) SetDeprecatedBundlesEnabled(v bool)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedCleanSync deprecated 

func (x *PreflightResponse) SetDeprecatedCleanSync(v bool)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedEnabledTransitiveWhitelisting deprecated 

func (x *PreflightResponse) SetDeprecatedEnabledTransitiveWhitelisting(v bool)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedFcmFullSyncIntervalSeconds deprecated 

func (x *PreflightResponse) SetDeprecatedFcmFullSyncIntervalSeconds(v uint32)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedFcmGlobalRuleSyncDeadlineSeconds deprecated 

func (x *PreflightResponse) SetDeprecatedFcmGlobalRuleSyncDeadlineSeconds(v uint32)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedTransitiveWhitelistingEnabled deprecated 

func (x *PreflightResponse) SetDeprecatedTransitiveWhitelistingEnabled(v bool)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDeprecatedWhitelistRegex deprecated 

func (x *PreflightResponse) SetDeprecatedWhitelistRegex(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetDisableUnknownEventUpload ¶ 

func (x *PreflightResponse) SetDisableUnknownEventUpload(v bool)

func (*PreflightResponse) SetEnableAllEventUpload ¶ 

func (x *PreflightResponse) SetEnableAllEventUpload(v bool)

func (*PreflightResponse) SetEnableBundles ¶ 

func (x *PreflightResponse) SetEnableBundles(v bool)

func (*PreflightResponse) SetEnableTransitiveRules ¶ 

func (x *PreflightResponse) SetEnableTransitiveRules(v bool)

func (*PreflightResponse) SetEncryptedRemovableMediaPolicy ¶ 

func (x *PreflightResponse) SetEncryptedRemovableMediaPolicy(v *RemovableMediaPolicy)

func (*PreflightResponse) SetEventDetailText ¶ 

func (x *PreflightResponse) SetEventDetailText(v string)

func (*PreflightResponse) SetEventDetailUrl ¶ 

func (x *PreflightResponse) SetEventDetailUrl(v string)

func (*PreflightResponse) SetExportConfiguration ¶ 

func (x *PreflightResponse) SetExportConfiguration(v *ExportConfiguration)

func (*PreflightResponse) SetFullSyncIntervalSeconds ¶ 

func (x *PreflightResponse) SetFullSyncIntervalSeconds(v uint32)

func (*PreflightResponse) SetOverrideFileAccessAction ¶ 

func (x *PreflightResponse) SetOverrideFileAccessAction(v FileAccessAction)

func (*PreflightResponse) SetPushIssuerToken ¶ 

func (x *PreflightResponse) SetPushIssuerToken(v string)

func (*PreflightResponse) SetPushNotificationFullSyncIntervalSeconds ¶ 

func (x *PreflightResponse) SetPushNotificationFullSyncIntervalSeconds(v uint32)

func (*PreflightResponse) SetPushNotificationGlobalRuleSyncDeadlineSeconds ¶ 

func (x *PreflightResponse) SetPushNotificationGlobalRuleSyncDeadlineSeconds(v uint32)

func (*PreflightResponse) SetPushToken ¶ 

func (x *PreflightResponse) SetPushToken(v string)

func (*PreflightResponse) SetRemountUsbMode deprecated 

func (x *PreflightResponse) SetRemountUsbMode(v []string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*PreflightResponse) SetRemovableMediaPolicy ¶ 

func (x *PreflightResponse) SetRemovableMediaPolicy(v *RemovableMediaPolicy)

func (*PreflightResponse) SetSyncType ¶ 

func (x *PreflightResponse) SetSyncType(v SyncType)

func (*PreflightResponse) String ¶ 

func (x *PreflightResponse) String() string

type PreflightResponse_builder ¶ 

type PreflightResponse_builder struct {

	// The client mode that the client should move into at the end of this sync.
	// The mode does not change until the Postflight request has been made, to
	// ensure the client has received all the needed rules before potentially
	// going into Lockdown.
	ClientMode ClientMode
	// The SyncType of this sync, which impacts how rules are applied. See the
	// comments on the `SyncType` enum to learn how Santa interprets this value.
	SyncType *SyncType
	// Controls how many events Santa should upload in a single EventUpload request.
	// If the server doesn't specify, the default is 50.
	BatchSize uint32
	// Enable bundle hashing and bundle rules. If this is enabled when a binary
	// is blocked Santa will try to determine the outermost bundle that it is a
	// part of and create a "bundle hash" for the whole bundle. When the sync
	// server receives this bundle hash it can decide whether to request that
	// Santa uploads more details about all of the binaries contained within the
	// bundle.
	EnableBundles *bool
	// Enable transitive (ALLOWLIST_COMPILER) rules.
	// Without this enabled, any received ALLOWLIST_COMPILER rules will be treated
	// as ALLOWLIST.
	EnableTransitiveRules *bool
	// Ordinarily, Santa will only upload events about executions that are denied
	// or would be denied if the machine were in LOCKDOWN mode. With this enabled,
	// Santa will upload details about all events. It is important to note that
	// due to caching, not every execution will be logged, only those that require
	// Santa to make a decision. If you want information about every single
	// execution, with much more fidelity than is available from Events,
	// Santa can record telemetry by configuring the Telemetry, EventLogType, and
	// EventLogPath keys in the configuration profile.
	EnableAllEventUpload *bool
	// Ordinarily, Santa will only upload events about executions that are denied
	// or would be denied if the machine were in LOCKDOWN mode. With this enabled,
	// Santa will NOT upload events for binaries that would have been blocked in LOCKDOWN.
	DisableUnknownEventUpload *bool
	// Specifies the time interval in seconds between full syncs.
	// Defaults to 600 (10 minutes). Cannot be set lower than 60.
	FullSyncIntervalSeconds uint32
	// When push notifications are enabled, this overrides the full_sync_interval
	// above. It is expected that Santa will not need to perform a full sync as
	// frequently when push notifications are working.
	// Defaults to 14400 (4 hours).
	PushNotificationFullSyncIntervalSeconds uint32
	// The maximum number of seconds Santa can wait before triggering a rule sync
	// after receiving a "global rule sync" notification. As these notifications
	// cause every Santa client to try and sync, we add a random delay to each
	// client to try and spread the load out on the sync server.
	// Defaults to 600 (10 minutes).
	PushNotificationGlobalRuleSyncDeadlineSeconds uint32
	// A regex, in ICU format, that if an execution from a path matches the regex
	// and the execution has not already matched any other rules, will cause the
	// execution to be allowed. While this feature can be useful, its use should
	// be very carefully considered as it is much riskier than real rules.
	// N.b: `blocked_path_regex` is applied before `allowed_path_regex`, if both
	// are configured.
	AllowedPathRegex *string
	// A regex, in ICU format, that if an execution from a path matches the regex
	// and the execution has not already matched any other rules, will cause the
	// execution to be blocked. While this feature can be useful, its use should
	// be very carefully considered as it is much riskier than real rules.
	BlockedPathRegex *string
	// Deprecated: use `removable_media_mount_control` instead.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	BlockUsbMount *bool
	// Baseline policy for all removable media.
	// If unset, falls back to deprecated `block_usb_mount` + `remount_usb_mode`.
	RemovableMediaPolicy *RemovableMediaPolicy
	// Optional override for encrypted volumes.
	// If unset, encrypted volumes use `removable_media_policy`.
	EncryptedRemovableMediaPolicy *RemovableMediaPolicy
	// If set, if a mount of a USB device happens and the mount flags match, the
	// mount will be allowed. If the flags do not match, Santa will deny the mount
	// but then remount with the provided flags.
	// `remount_usb_mode` is deprecated. Use removable_media_policy instead.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	RemountUsbMode []string
	// Overrides the File Access Authorization (FAA) policy to change the performed action.
	// Allowed values:
	//
	//	`disable`: No action will be taken
	//	`auditonly`: Actions that would be denied are logged but allowed
	//	`none`: The policy will be applied as written
	OverrideFileAccessAction *FileAccessAction
	// If set, contains the configuration Santa needs to export data to the
	// configured destination.
	ExportConfiguration *ExportConfiguration
	// The signed JWT push token chain used to upgrade sync v1 connections to sync
	// v2.
	PushToken       string
	PushIssuerToken string
	// The URL to open when the user clicks the button on a block notification.
	// This URL will be used for all rules unless overridden by a rule-specific
	// option. This property supports several placeholders in the string that
	// will be replaced before the URL is constructed. Refer to Santa
	// documentation for a complete list of supported placeholders.
	EventDetailUrl *string
	// Related to the event_detail_url, this string represents the text to show
	// on the button of the block notification show to a user.
	EventDetailText *string
	// These fields are deprecated forms of other fields and exist here solely for
	// backwards compatibility.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedEnabledTransitiveWhitelisting *bool
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedTransitiveWhitelistingEnabled *bool
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedBundlesEnabled *bool
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedFcmFullSyncIntervalSeconds *uint32
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedFcmGlobalRuleSyncDeadlineSeconds *uint32
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedWhitelistRegex *string
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedBlacklistRegex *string
	// Deprecated but still supported key that acts like sync_type was set to
	// "CLEAN" unless the client had requested a clean sync, in which case it acts
	// like "CLEAN_ALL"
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedCleanSync *bool
	// contains filtered or unexported fields
}

func (PreflightResponse_builder) Build ¶ 

func (b0 PreflightResponse_builder) Build() *PreflightResponse

type Process ¶ 

type Process struct {

	// The path containing this binary, e.g. /usr/bin
	FilePath string `protobuf:"bytes,1,opt,name=file_path,proto3" json:"file_path,omitempty"`
	// The CDHash of the binary, if it is validly signed.
	Cdhash string `protobuf:"bytes,2,opt,name=cdhash,proto3" json:"cdhash,omitempty"`
	// The SHA-256 of the binary file being executed.
	FileSha256 string `protobuf:"bytes,3,opt,name=file_sha256,proto3" json:"file_sha256,omitempty"`
	// The signing ID of the binary being executed.
	// For binaries that are part of macOS this will be prefixed with platform:
	// For binaries that are signed by a valid developer certificate this will
	//
	//	be prefixed with the signer's team ID.
	SigningId string `protobuf:"bytes,4,opt,name=signing_id,proto3" json:"signing_id,omitempty"`
	// The team ID of the binary being executed.
	TeamId string `protobuf:"bytes,5,opt,name=team_id,proto3" json:"team_id,omitempty"`
	// The process ID of the execution
	Pid int32 `protobuf:"varint,6,opt,name=pid,proto3" json:"pid,omitempty"`
	// If the binary is properly signed, this field contains details of all of
	// the certificates in the signing chain, starting at the leaf certificate
	// (the one that directly signed the binary) leading up to a root.
	SigningChain []*Certificate `protobuf:"bytes,7,rep,name=signing_chain,proto3" json:"signing_chain,omitempty"`
	// contains filtered or unexported fields
}

Information about a given process. This can optionally be used to represent a chain of process ancestors.

func (*Process) GetCdhash ¶ 

func (x *Process) GetCdhash() string

func (*Process) GetFilePath ¶ 

func (x *Process) GetFilePath() string

func (*Process) GetFileSha256 ¶ 

func (x *Process) GetFileSha256() string

func (*Process) GetPid ¶ 

func (x *Process) GetPid() int32

func (*Process) GetSigningChain ¶ 

func (x *Process) GetSigningChain() []*Certificate

func (*Process) GetSigningId ¶ 

func (x *Process) GetSigningId() string

func (*Process) GetTeamId ¶ 

func (x *Process) GetTeamId() string

func (*Process) ProtoMessage ¶ 

func (*Process) ProtoMessage()

func (*Process) ProtoReflect ¶ 

func (x *Process) ProtoReflect() protoreflect.Message

func (*Process) Reset ¶ 

func (x *Process) Reset()

func (*Process) SetCdhash ¶ 

func (x *Process) SetCdhash(v string)

func (*Process) SetFilePath ¶ 

func (x *Process) SetFilePath(v string)

func (*Process) SetFileSha256 ¶ 

func (x *Process) SetFileSha256(v string)

func (*Process) SetPid ¶ 

func (x *Process) SetPid(v int32)

func (*Process) SetSigningChain ¶ 

func (x *Process) SetSigningChain(v []*Certificate)

func (*Process) SetSigningId ¶ 

func (x *Process) SetSigningId(v string)

func (*Process) SetTeamId ¶ 

func (x *Process) SetTeamId(v string)

func (*Process) String ¶ 

func (x *Process) String() string

type Process_builder ¶ 

type Process_builder struct {

	// The path containing this binary, e.g. /usr/bin
	FilePath string
	// The CDHash of the binary, if it is validly signed.
	Cdhash string
	// The SHA-256 of the binary file being executed.
	FileSha256 string
	// The signing ID of the binary being executed.
	// For binaries that are part of macOS this will be prefixed with platform:
	// For binaries that are signed by a valid developer certificate this will
	//
	//	be prefixed with the signer's team ID.
	SigningId string
	// The team ID of the binary being executed.
	TeamId string
	// The process ID of the execution
	Pid int32
	// If the binary is properly signed, this field contains details of all of
	// the certificates in the signing chain, starting at the leaf certificate
	// (the one that directly signed the binary) leading up to a root.
	SigningChain []*Certificate
	// contains filtered or unexported fields
}

func (Process_builder) Build ¶ 

func (b0 Process_builder) Build() *Process

type RemountPolicy ¶ 

type RemountPolicy struct {
	Flags []string `protobuf:"bytes,1,rep,name=flags,proto3" json:"flags,omitempty"`
	// contains filtered or unexported fields
}

If set, if a mount of a USB device happens and the mount flags match, the mount will be allowed. If the flags do not match, Santa will deny the mount but then remount with the provided flags.

func (*RemountPolicy) GetFlags ¶ 

func (x *RemountPolicy) GetFlags() []string

func (*RemountPolicy) ProtoMessage ¶ 

func (*RemountPolicy) ProtoMessage()

func (*RemountPolicy) ProtoReflect ¶ 

func (x *RemountPolicy) ProtoReflect() protoreflect.Message

func (*RemountPolicy) Reset ¶ 

func (x *RemountPolicy) Reset()

func (*RemountPolicy) SetFlags ¶ 

func (x *RemountPolicy) SetFlags(v []string)

func (*RemountPolicy) String ¶ 

func (x *RemountPolicy) String() string

type RemountPolicy_builder ¶ 

type RemountPolicy_builder struct {
	Flags []string
	// contains filtered or unexported fields
}

func (RemountPolicy_builder) Build ¶ 

func (b0 RemountPolicy_builder) Build() *RemountPolicy

type RemovableMediaPolicy ¶ 

type RemovableMediaPolicy struct {

	// Types that are valid to be assigned to Action:
	//
	//	*RemovableMediaPolicy_Allow
	//	*RemovableMediaPolicy_Block
	//	*RemovableMediaPolicy_Remount
	Action isRemovableMediaPolicy_Action `protobuf_oneof:"action"`
	// contains filtered or unexported fields
}

Controls how removable media mounts (e.g. USB devices) are handled.

func (*RemovableMediaPolicy) ClearAction ¶ 

func (x *RemovableMediaPolicy) ClearAction()

func (*RemovableMediaPolicy) ClearAllow ¶ 

func (x *RemovableMediaPolicy) ClearAllow()

func (*RemovableMediaPolicy) ClearBlock ¶ 

func (x *RemovableMediaPolicy) ClearBlock()

func (*RemovableMediaPolicy) ClearRemount ¶ 

func (x *RemovableMediaPolicy) ClearRemount()

func (*RemovableMediaPolicy) GetAction ¶ 

func (x *RemovableMediaPolicy) GetAction() isRemovableMediaPolicy_Action

func (*RemovableMediaPolicy) GetAllow ¶ 

func (x *RemovableMediaPolicy) GetAllow() bool

func (*RemovableMediaPolicy) GetBlock ¶ 

func (x *RemovableMediaPolicy) GetBlock() bool

func (*RemovableMediaPolicy) GetRemount ¶ 

func (x *RemovableMediaPolicy) GetRemount() *RemountPolicy

func (*RemovableMediaPolicy) HasAction ¶ 

func (x *RemovableMediaPolicy) HasAction() bool

func (*RemovableMediaPolicy) HasAllow ¶ 

func (x *RemovableMediaPolicy) HasAllow() bool

func (*RemovableMediaPolicy) HasBlock ¶ 

func (x *RemovableMediaPolicy) HasBlock() bool

func (*RemovableMediaPolicy) HasRemount ¶ 

func (x *RemovableMediaPolicy) HasRemount() bool

func (*RemovableMediaPolicy) ProtoMessage ¶ 

func (*RemovableMediaPolicy) ProtoMessage()

func (*RemovableMediaPolicy) ProtoReflect ¶ 

func (x *RemovableMediaPolicy) ProtoReflect() protoreflect.Message

func (*RemovableMediaPolicy) Reset ¶ 

func (x *RemovableMediaPolicy) Reset()

func (*RemovableMediaPolicy) SetAllow ¶ 

func (x *RemovableMediaPolicy) SetAllow(v bool)

func (*RemovableMediaPolicy) SetBlock ¶ 

func (x *RemovableMediaPolicy) SetBlock(v bool)

func (*RemovableMediaPolicy) SetRemount ¶ 

func (x *RemovableMediaPolicy) SetRemount(v *RemountPolicy)

func (*RemovableMediaPolicy) String ¶ 

func (x *RemovableMediaPolicy) String() string

func (*RemovableMediaPolicy) WhichAction ¶ 

func (x *RemovableMediaPolicy) WhichAction() case_RemovableMediaPolicy_Action

type RemovableMediaPolicy_Allow ¶ 

type RemovableMediaPolicy_Allow struct {
	Allow bool `protobuf:"varint,1,opt,name=allow,proto3,oneof"`
}

type RemovableMediaPolicy_Block ¶ 

type RemovableMediaPolicy_Block struct {
	Block bool `protobuf:"varint,2,opt,name=block,proto3,oneof"`
}

type RemovableMediaPolicy_Remount ¶ 

type RemovableMediaPolicy_Remount struct {
	Remount *RemountPolicy `protobuf:"bytes,3,opt,name=remount,proto3,oneof"`
}

type RemovableMediaPolicy_builder ¶ 

type RemovableMediaPolicy_builder struct {

	// Fields of oneof Action:
	Allow   *bool
	Block   *bool
	Remount *RemountPolicy
	// contains filtered or unexported fields
}

func (RemovableMediaPolicy_builder) Build ¶ 

func (b0 RemovableMediaPolicy_builder) Build() *RemovableMediaPolicy

type Rule ¶ 

type Rule struct {

	// The identifier for this rule. How this field is interpreted depends on the
	// `rule_type` field.
	Identifier string `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
	// The policy for this rule, e.g. ALLOWLIST, BLOCKLIST.
	Policy Policy `protobuf:"varint,2,opt,name=policy,proto3,enum=santa.sync.v1.Policy" json:"policy,omitempty"`
	// The type for this rule, see the RuleType enum for details on the values.
	RuleType RuleType `protobuf:"varint,3,opt,name=rule_type,json=ruleType,proto3,enum=santa.sync.v1.RuleType" json:"rule_type,omitempty"`
	// For BLOCK_* rules, this will override the default block message shown to
	// users.
	CustomMsg string `protobuf:"bytes,4,opt,name=custom_msg,json=customMsg,proto3" json:"custom_msg,omitempty"`
	// For BLOCK_* rules, this will override the URL used by the "Open" button in
	// the UI. The same format values used by the EventDetailURL configuration
	// value can be used here.
	// See: https://santa.dev/deployment/configuration#eventdetailurl
	CustomUrl string `protobuf:"bytes,5,opt,name=custom_url,json=customUrl,proto3" json:"custom_url,omitempty"`
	// This field is deprecated, use `notification_app_name` instead.
	// If the `file_bundle_hash` is populated, the client can use this as a signal
	// that an application that previously has been blocked is now allowed and to
	// show a system notification that this is the case.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileBundleHash string `protobuf:"bytes,6,opt,name=file_bundle_hash,json=fileBundleHash,proto3" json:"file_bundle_hash,omitempty"`
	// This field is deprecated, use `notification_app_name` instead.
	// If the `file_bundle_binary_count` is populated, the notification shown that
	// an application is allowed will not be presented until rules for all the
	// binaries have been received.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileBundleBinaryCount uint32 `` /* 129-byte string literal not displayed */
	// If `notification_app_name` is populated, a system notification message will
	// be shown with its content. Ignored during clean sync.
	// This field supersedes the behavior of `file_bundle_hash` and
	// `file_bundle_binary_count`.
	NotificationAppName string `protobuf:"bytes,8,opt,name=notification_app_name,json=notificationAppName,proto3" json:"notification_app_name,omitempty"`
	// The CEL expression to run when evaluating this rule.
	// This field is only used for rules with a Policy of CEL and is required
	// in this case.
	CelExpr string `protobuf:"bytes,9,opt,name=cel_expr,json=celExpr,proto3" json:"cel_expr,omitempty"`
	// For BLOCK_* rules, this will override the text shown on the "Open" button in
	// the UI. Overrides the EventDetailText configuration value.
	// See: https://santa.dev/deployment/configuration#eventdetailtext
	EventDetailButtonLabel string `` /* 132-byte string literal not displayed */
	// This field is deprecated and has been replaced with `identifier`.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedSha256 string `protobuf:"bytes,1000,opt,name=deprecated_sha256,json=sha256,proto3" json:"deprecated_sha256,omitempty"`
	// contains filtered or unexported fields
}

func (*Rule) GetCelExpr ¶ 

func (x *Rule) GetCelExpr() string

func (*Rule) GetCustomMsg ¶ 

func (x *Rule) GetCustomMsg() string

func (*Rule) GetCustomUrl ¶ 

func (x *Rule) GetCustomUrl() string

func (*Rule) GetDeprecatedSha256 deprecated 

func (x *Rule) GetDeprecatedSha256() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) GetEventDetailButtonLabel ¶ 

func (x *Rule) GetEventDetailButtonLabel() string

func (*Rule) GetFileBundleBinaryCount deprecated 

func (x *Rule) GetFileBundleBinaryCount() uint32

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) GetFileBundleHash deprecated 

func (x *Rule) GetFileBundleHash() string

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) GetIdentifier ¶ 

func (x *Rule) GetIdentifier() string

func (*Rule) GetNotificationAppName ¶ 

func (x *Rule) GetNotificationAppName() string

func (*Rule) GetPolicy ¶ 

func (x *Rule) GetPolicy() Policy

func (*Rule) GetRuleType ¶ 

func (x *Rule) GetRuleType() RuleType

func (*Rule) ProtoMessage ¶ 

func (*Rule) ProtoMessage()

func (*Rule) ProtoReflect ¶ 

func (x *Rule) ProtoReflect() protoreflect.Message

func (*Rule) Reset ¶ 

func (x *Rule) Reset()

func (*Rule) SetCelExpr ¶ 

func (x *Rule) SetCelExpr(v string)

func (*Rule) SetCustomMsg ¶ 

func (x *Rule) SetCustomMsg(v string)

func (*Rule) SetCustomUrl ¶ 

func (x *Rule) SetCustomUrl(v string)

func (*Rule) SetDeprecatedSha256 deprecated 

func (x *Rule) SetDeprecatedSha256(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) SetEventDetailButtonLabel ¶ 

func (x *Rule) SetEventDetailButtonLabel(v string)

func (*Rule) SetFileBundleBinaryCount deprecated 

func (x *Rule) SetFileBundleBinaryCount(v uint32)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) SetFileBundleHash deprecated 

func (x *Rule) SetFileBundleHash(v string)

Deprecated: Marked as deprecated in sync/v1.proto.

func (*Rule) SetIdentifier ¶ 

func (x *Rule) SetIdentifier(v string)

func (*Rule) SetNotificationAppName ¶ 

func (x *Rule) SetNotificationAppName(v string)

func (*Rule) SetPolicy ¶ 

func (x *Rule) SetPolicy(v Policy)

func (*Rule) SetRuleType ¶ 

func (x *Rule) SetRuleType(v RuleType)

func (*Rule) String ¶ 

func (x *Rule) String() string

type RuleDownloadRequest ¶ 

type RuleDownloadRequest struct {

	// When Santa downloads rules from the server, the server can return a
	// "cursor" that is sent back in the next request. This can be used to
	// paginate, or split up, responses, and avoid sending a very large number of
	// rules in a single response. The value of this field is not interpreted in
	// any way by the client, but if it is populated with anything, it is a signal
	// to the client that more rules are remaining and that it should make another
	// request, sending the cursor back.
	Cursor string `protobuf:"bytes,1,opt,name=cursor,proto3" json:"cursor,omitempty"`
	// The UUID of the machine requesting rules. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string `protobuf:"bytes,2,opt,name=machine_id,proto3" json:"machine_id,omitempty"`
	// contains filtered or unexported fields
}

func (*RuleDownloadRequest) GetCursor ¶ 

func (x *RuleDownloadRequest) GetCursor() string

func (*RuleDownloadRequest) GetMachineId ¶ 

func (x *RuleDownloadRequest) GetMachineId() string

func (*RuleDownloadRequest) ProtoMessage ¶ 

func (*RuleDownloadRequest) ProtoMessage()

func (*RuleDownloadRequest) ProtoReflect ¶ 

func (x *RuleDownloadRequest) ProtoReflect() protoreflect.Message

func (*RuleDownloadRequest) Reset ¶ 

func (x *RuleDownloadRequest) Reset()

func (*RuleDownloadRequest) SetCursor ¶ 

func (x *RuleDownloadRequest) SetCursor(v string)

func (*RuleDownloadRequest) SetMachineId ¶ 

func (x *RuleDownloadRequest) SetMachineId(v string)

func (*RuleDownloadRequest) String ¶ 

func (x *RuleDownloadRequest) String() string

type RuleDownloadRequest_builder ¶ 

type RuleDownloadRequest_builder struct {

	// When Santa downloads rules from the server, the server can return a
	// "cursor" that is sent back in the next request. This can be used to
	// paginate, or split up, responses, and avoid sending a very large number of
	// rules in a single response. The value of this field is not interpreted in
	// any way by the client, but if it is populated with anything, it is a signal
	// to the client that more rules are remaining and that it should make another
	// request, sending the cursor back.
	Cursor string
	// The UUID of the machine requesting rules. See the comment
	// above the same field in `PreflightRequest` for more details.
	MachineId string
	// contains filtered or unexported fields
}

func (RuleDownloadRequest_builder) Build ¶ 

func (b0 RuleDownloadRequest_builder) Build() *RuleDownloadRequest

type RuleDownloadResponse ¶ 

type RuleDownloadResponse struct {

	// The set of rules returned in this response.
	Rules []*Rule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// The aforementioned cursor (see the comment on `RuleDownloadRequest`).
	Cursor string `protobuf:"bytes,2,opt,name=cursor,proto3" json:"cursor,omitempty"`
	// contains filtered or unexported fields
}

func (*RuleDownloadResponse) GetCursor ¶ 

func (x *RuleDownloadResponse) GetCursor() string

func (*RuleDownloadResponse) GetRules ¶ 

func (x *RuleDownloadResponse) GetRules() []*Rule

func (*RuleDownloadResponse) ProtoMessage ¶ 

func (*RuleDownloadResponse) ProtoMessage()

func (*RuleDownloadResponse) ProtoReflect ¶ 

func (x *RuleDownloadResponse) ProtoReflect() protoreflect.Message

func (*RuleDownloadResponse) Reset ¶ 

func (x *RuleDownloadResponse) Reset()

func (*RuleDownloadResponse) SetCursor ¶ 

func (x *RuleDownloadResponse) SetCursor(v string)

func (*RuleDownloadResponse) SetRules ¶ 

func (x *RuleDownloadResponse) SetRules(v []*Rule)

func (*RuleDownloadResponse) String ¶ 

func (x *RuleDownloadResponse) String() string

type RuleDownloadResponse_builder ¶ 

type RuleDownloadResponse_builder struct {

	// The set of rules returned in this response.
	Rules []*Rule
	// The aforementioned cursor (see the comment on `RuleDownloadRequest`).
	Cursor string
	// contains filtered or unexported fields
}

func (RuleDownloadResponse_builder) Build ¶ 

func (b0 RuleDownloadResponse_builder) Build() *RuleDownloadResponse

type RuleType ¶ 

type RuleType int32

The type of a rule, determining how the identifier should be interpreted. 

const (
	// Should never be set, will be ignored.
	RuleType_RULETYPE_UNKNOWN RuleType = 0
	// A binary rule identifies a binary by its SHA-256 hash.
	RuleType_BINARY RuleType = 1
	// A certificate rule identifies the leaf certificate that signed a binary
	// by its SHA-256 hash.
	RuleType_CERTIFICATE RuleType = 2
	// A team ID rule identifies a publisher by the 10 character ID issued by
	// Apple and contained within the signing certificate, e.g. EQHXZ8M8AV.
	// This allows creating rules for a publisher that will continue to work as
	// the publisher rotates their signing certificates.
	RuleType_TEAMID RuleType = 3
	// A signing ID rule identifies a binary by the signing ID
	// (kSecCodeInfoIdentifier) sealed into the signature, prefixed with the team
	// ID of the publisher (or platform, if the binary is part of macOS).
	// E.g. UBF8T346G9:com.microsoft.VSCode or platform:com.apple.yes.
	RuleType_SIGNINGID RuleType = 4
	// A CDHash rule identifies a binary by its CDHash, if it is properly signed.
	RuleType_CDHASH RuleType = 5
)

func (RuleType) Descriptor ¶ 

func (RuleType) Descriptor() protoreflect.EnumDescriptor

func (RuleType) Enum ¶ 

func (x RuleType) Enum() *RuleType

func (RuleType) Number ¶ 

func (x RuleType) Number() protoreflect.EnumNumber

func (RuleType) String ¶ 

func (x RuleType) String() string

func (RuleType) Type ¶ 

func (RuleType) Type() protoreflect.EnumType

type Rule_builder ¶ 

type Rule_builder struct {

	// The identifier for this rule. How this field is interpreted depends on the
	// `rule_type` field.
	Identifier string
	// The policy for this rule, e.g. ALLOWLIST, BLOCKLIST.
	Policy Policy
	// The type for this rule, see the RuleType enum for details on the values.
	RuleType RuleType
	// For BLOCK_* rules, this will override the default block message shown to
	// users.
	CustomMsg string
	// For BLOCK_* rules, this will override the URL used by the "Open" button in
	// the UI. The same format values used by the EventDetailURL configuration
	// value can be used here.
	// See: https://santa.dev/deployment/configuration#eventdetailurl
	CustomUrl string
	// This field is deprecated, use `notification_app_name` instead.
	// If the `file_bundle_hash` is populated, the client can use this as a signal
	// that an application that previously has been blocked is now allowed and to
	// show a system notification that this is the case.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileBundleHash string
	// This field is deprecated, use `notification_app_name` instead.
	// If the `file_bundle_binary_count` is populated, the notification shown that
	// an application is allowed will not be presented until rules for all the
	// binaries have been received.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	FileBundleBinaryCount uint32
	// If `notification_app_name` is populated, a system notification message will
	// be shown with its content. Ignored during clean sync.
	// This field supersedes the behavior of `file_bundle_hash` and
	// `file_bundle_binary_count`.
	NotificationAppName string
	// The CEL expression to run when evaluating this rule.
	// This field is only used for rules with a Policy of CEL and is required
	// in this case.
	CelExpr string
	// For BLOCK_* rules, this will override the text shown on the "Open" button in
	// the UI. Overrides the EventDetailText configuration value.
	// See: https://santa.dev/deployment/configuration#eventdetailtext
	EventDetailButtonLabel string
	// This field is deprecated and has been replaced with `identifier`.
	//
	// Deprecated: Marked as deprecated in sync/v1.proto.
	DeprecatedSha256 string
	// contains filtered or unexported fields
}

func (Rule_builder) Build ¶ 

func (b0 Rule_builder) Build() *Rule

type SignedPost ¶ 

type SignedPost struct {

	// POST URL to send the signed form values and desired data. Use content type
	// multipart/form-data when making the request.
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// Signed values which authorize the POST request. Append the desired object
	// name to the "key" field.
	FormValues map[string]string `` /* 165-byte string literal not displayed */
	// contains filtered or unexported fields
}

A presigned POST request that can be used to upload data.

func (*SignedPost) GetFormValues ¶ 

func (x *SignedPost) GetFormValues() map[string]string

func (*SignedPost) GetUrl ¶ 

func (x *SignedPost) GetUrl() string

func (*SignedPost) ProtoMessage ¶ 

func (*SignedPost) ProtoMessage()

func (*SignedPost) ProtoReflect ¶ 

func (x *SignedPost) ProtoReflect() protoreflect.Message

func (*SignedPost) Reset ¶ 

func (x *SignedPost) Reset()

func (*SignedPost) SetFormValues ¶ 

func (x *SignedPost) SetFormValues(v map[string]string)

func (*SignedPost) SetUrl ¶ 

func (x *SignedPost) SetUrl(v string)

func (*SignedPost) String ¶ 

func (x *SignedPost) String() string

type SignedPost_builder ¶ 

type SignedPost_builder struct {

	// POST URL to send the signed form values and desired data. Use content type
	// multipart/form-data when making the request.
	Url string
	// Signed values which authorize the POST request. Append the desired object
	// name to the "key" field.
	FormValues map[string]string
	// contains filtered or unexported fields
}

func (SignedPost_builder) Build ¶ 

func (b0 SignedPost_builder) Build() *SignedPost

type SigningStatus ¶ 

type SigningStatus int32

Status of the analysis of the leaf signing certificate. 

const (
	SigningStatus_SIGNING_STATUS_UNSPECIFIED SigningStatus = 0
	// The executing binary wasn't signed
	SigningStatus_SIGNING_STATUS_UNSIGNED SigningStatus = 1
	// There was a problem checking the validity of the code signature of the
	// executing binary or its code signature was invalid.
	SigningStatus_SIGNING_STATUS_INVALID SigningStatus = 2
	// The executing binary was ad-hoc signed
	SigningStatus_SIGNING_STATUS_ADHOC SigningStatus = 3
	// The executing binary was validly signed with a development certificate
	SigningStatus_SIGNING_STATUS_DEVELOPMENT SigningStatus = 4
	// The executing binary was validly signed with a production certificate
	SigningStatus_SIGNING_STATUS_PRODUCTION SigningStatus = 5
)

func (SigningStatus) Descriptor ¶ 

func (SigningStatus) Descriptor() protoreflect.EnumDescriptor

func (SigningStatus) Enum ¶ 

func (x SigningStatus) Enum() *SigningStatus

func (SigningStatus) Number ¶ 

func (x SigningStatus) Number() protoreflect.EnumNumber

func (SigningStatus) String ¶ 

func (x SigningStatus) String() string

func (SigningStatus) Type ¶ 

func (SigningStatus) Type() protoreflect.EnumType

type StandaloneModeRuleCreation ¶ 

type StandaloneModeRuleCreation struct {
	Decision   Decision `protobuf:"varint,1,opt,name=decision,proto3,enum=santa.sync.v1.Decision" json:"decision,omitempty"` // Indicates new rule type
	Identifier string   `protobuf:"bytes,2,opt,name=identifier,proto3" json:"identifier,omitempty"`                          // Indicates new rule identifier
	Timestamp  uint32   `protobuf:"varint,3,opt,name=timestamp,proto3" json:"timestamp,omitempty"`                           // Timestamp of rule creation
	// contains filtered or unexported fields
}

Audit Event for when Santa makes a new rule in standalone mode.

func (*StandaloneModeRuleCreation) GetDecision ¶ 

func (x *StandaloneModeRuleCreation) GetDecision() Decision

func (*StandaloneModeRuleCreation) GetIdentifier ¶ 

func (x *StandaloneModeRuleCreation) GetIdentifier() string

func (*StandaloneModeRuleCreation) GetTimestamp ¶ 

func (x *StandaloneModeRuleCreation) GetTimestamp() uint32

func (*StandaloneModeRuleCreation) ProtoMessage ¶ 

func (*StandaloneModeRuleCreation) ProtoMessage()

func (*StandaloneModeRuleCreation) ProtoReflect ¶ 

func (x *StandaloneModeRuleCreation) ProtoReflect() protoreflect.Message

func (*StandaloneModeRuleCreation) Reset ¶ 

func (x *StandaloneModeRuleCreation) Reset()

func (*StandaloneModeRuleCreation) SetDecision ¶ 

func (x *StandaloneModeRuleCreation) SetDecision(v Decision)

func (*StandaloneModeRuleCreation) SetIdentifier ¶ 

func (x *StandaloneModeRuleCreation) SetIdentifier(v string)

func (*StandaloneModeRuleCreation) SetTimestamp ¶ 

func (x *StandaloneModeRuleCreation) SetTimestamp(v uint32)

func (*StandaloneModeRuleCreation) String ¶ 

func (x *StandaloneModeRuleCreation) String() string

type StandaloneModeRuleCreation_builder ¶ 

type StandaloneModeRuleCreation_builder struct {
	Decision   Decision
	Identifier string
	Timestamp  uint32
	// contains filtered or unexported fields
}

func (StandaloneModeRuleCreation_builder) Build ¶ 

func (b0 StandaloneModeRuleCreation_builder) Build() *StandaloneModeRuleCreation

type SyncType ¶ 

type SyncType int32
const (
	// An unspecified SyncType will fallback to default "NORMAL" handling
	SyncType_SYNC_TYPE_UNSPECIFIED SyncType = 0
	// Standard, progressive sync.
	// Santa will apply newly received rules on top of any existing rules. If a
	// an existing rule with a matching `identifier` and `rule_type`, the rule
	// will be replaced. If a received rule has the policy `REMOVE` then the rule
	// will be removed.
	SyncType_NORMAL SyncType = 1
	// Deprecated: Marked as deprecated in sync/v1.proto.
	SyncType_normal SyncType = 1
	// Delete all non-transitive, previously received rules before applying the newly received rules.
	// Also delete all existing file access rules before applying newly received file access rules.
	SyncType_CLEAN SyncType = 2
	// Deprecated: Marked as deprecated in sync/v1.proto.
	SyncType_clean SyncType = 2
	// Delete all previously received rules before applying the newly received rules.
	// Also delete all existing file access rules before applying newly received file access rules.
	SyncType_CLEAN_ALL SyncType = 3
	// Deprecated: Marked as deprecated in sync/v1.proto.
	SyncType_clean_all SyncType = 3
	// Delete rules created in Standalone mode before applying the newly received rules.
	SyncType_CLEAN_STANDALONE SyncType = 4
	// Delete all non-transitive, previously received rules before applying the newly received rules.
	// Only execution rules are deleted, file access rules are left alone.
	SyncType_CLEAN_RULES SyncType = 5
	// Delete all existing file access rules before applying newly received file access rules.
	// Only file access rules are deleted, execution rules are left alone.
	SyncType_CLEAN_FILE_ACCESS_RULES SyncType = 6
)

func (SyncType) Descriptor ¶ 

func (SyncType) Descriptor() protoreflect.EnumDescriptor

func (SyncType) Enum ¶ 

func (x SyncType) Enum() *SyncType

func (SyncType) Number ¶ 

func (x SyncType) Number() protoreflect.EnumNumber

func (SyncType) String ¶ 

func (x SyncType) String() string

func (SyncType) Type ¶ 

func (SyncType) Type() protoreflect.EnumType

Source Files ¶

  • v1.pb.go

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.