e8b7fdff64
* WIP Major modernization effort for many of the Santa docs * Update IPC concept doc and diagram * WIP - Apply suggestions from code review Only some of the comments are included in this first commit. Co-authored-by: Kathryn May <44557882+kathancox@users.noreply.github.com> Co-authored-by: Russell Hancox <russellhancox@users.noreply.github.com> * WIP - Part 2 - Apply suggestions from code review Adding some more suggestions. Still more to go through. Co-authored-by: Kathryn May <44557882+kathancox@users.noreply.github.com> Co-authored-by: Russell Hancox <russellhancox@users.noreply.github.com> * WIP Adding more PR suggestions * WIP - Apply suggestions from code review More commits from reviewers Co-authored-by: Kathryn May <44557882+kathancox@users.noreply.github.com> Co-authored-by: Russell Hancox <russellhancox@users.noreply.github.com> Co-authored-by: Pete Markowsky <pmarkowsky@users.noreply.github.com> * WIP - Apply suggestions from code review More PR suggestions Co-authored-by: Pete Markowsky <pmarkowsky@users.noreply.github.com> Co-authored-by: Kathryn May <44557882+kathancox@users.noreply.github.com> * WIP addressed more PR feedback * WIP - More PR feedback * WIP - More PR feedback on bundle identification. Link updates * WIP - Clarify bundle events * WIP - clarify how to request bundle binary events * Update santad setup tasks * Fix doc link * Update docs/binaries/santa-gui.md Co-authored-by: Pete Markowsky <pmarkowsky@users.noreply.github.com> --------- Co-authored-by: Kathryn May <44557882+kathancox@users.noreply.github.com> Co-authored-by: Russell Hancox <russellhancox@users.noreply.github.com> Co-authored-by: Pete Markowsky <pmarkowsky@users.noreply.github.com>
1.6 KiB
parent
| parent |
|---|
| Concepts |
Mode
Santa can run in one of two modes, Lockdown or Monitor. To check the current
mode, use the santactl status command, for example:
⇒ santactl status | grep "^ Mode"
Mode | Lockdown
Monitor mode
The default mode. Running Santa in Monitor Mode will stop any binaries matching block rules, but will not stop unknown binaries from running. This is a flexible state, allowing virtually zero user interruption but still gives protection against known blocked binaries. In addition execution events that would have been blocked in Lockdown mode are generated and can be collected and analyzed by a sync server.
Lockdown mode
Running Santa in Lockdown Mode will stop all blocked binaries and additionally will prevent all unknown binaries from running. This means that if the binary has no rules or scopes that apply, then it will be blocked.
Changing Modes
There are two ways to change the running mode: changing the configuration profile and with a sync server configuration.
Change modes with the configuration profile
Set the ClientMode in your configuration profile to the integer value 1 for
MONITOR or 2 for LOCKDOWN.
<key>ClientMode</key>
<integer>1</integer>
Install your new configuration profile, it will overwrite any old
com.google.santa profiles you may have already install. See the
configuration document for more details.
Change modes with a sync server
The mode is set in the preflight sync stage. Use the key client_mode and a
value of MONITOR or LOCKDOWN.