diff --git a/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig
new file mode 100644
index 0000000000..9a056ac6a8
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig
@@ -0,0 +1,77 @@
+
+
+
+
+ PayloadContent
+
+
+ PayloadContent
+
+ com.northpolesec.santa
+
+ Forced
+
+
+ mcx_preference_settings
+
+ BannedBlockMessage
+ This application has been banned
+ ClientMode
+ 1
+ EnablePageZeroProtection
+
+ EnableSilentMode
+
+ FileChangesRegex
+ ^/(?!(?:private/tmp|Library/(?:Caches|Managed Installs/Logs|(?:Managed )?Preferences))/)
+ MachineIDKey
+ MachineUUID
+ MachineIDPlist
+ /Library/Preferences/com.company.machine-mapping.plist
+ MachineOwnerKey
+ Owner
+ MachineOwnerPlist
+ /Library/Preferences/com.company.machine-mapping.plist
+ ModeNotificationLockdown
+ Entering Lockdown mode
+ ModeNotificationMonitor
+ Entering Monitor mode<br/>Please be careful!
+ UnknownBlockMessage
+ This application has been blocked from executing.
+
+
+
+
+
+ PayloadEnabled
+
+ PayloadIdentifier
+ 0342c558-a101-4a08-a0b9-40cc00039ea5
+ PayloadType
+ com.apple.ManagedClient.preferences
+ PayloadUUID
+ 0342c558-a101-4a08-a0b9-40cc00039ea5
+ PayloadVersion
+ 1
+
+
+ PayloadDescription
+ com.northpolesec.santa
+ PayloadDisplayName
+ Santa - Configuration (no rules or sync server)
+ PayloadIdentifier
+ com.northpolesec.santa
+ PayloadOrganization
+
+ PayloadRemovalDisallowed
+
+ PayloadScope
+ System
+ PayloadType
+ Configuration
+ PayloadUUID
+ 9020fb2d-cab3-420f-9268-acca4868bdd0
+ PayloadVersion
+ 1
+
+
diff --git a/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig
new file mode 100644
index 0000000000..928979a2b6
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig
@@ -0,0 +1,64 @@
+
+
+
+
+ PayloadContent
+
+
+ NotificationSettings
+
+
+ AlertType
+ 1
+ BadgesEnabled
+
+ BundleIdentifier
+ com.northpolesec.santa
+ CriticalAlertEnabled
+
+ NotificationsEnabled
+
+ ShowInLockScreen
+
+ ShowInNotificationCenter
+
+ SoundsEnabled
+
+
+
+ PayloadDisplayName
+ Notifications Payload
+ PayloadIdentifier
+ com.northpolesec.santa.notificationsettings.F1817DA0-0044-43DD-9540-36EBC60FDA8F
+ PayloadOrganization
+
+ PayloadType
+ com.apple.notificationsettings
+ PayloadUUID
+ 510236AE-D7F8-4131-A4CA-5CC930C51866
+ PayloadVersion
+ 1
+
+
+ PayloadDescription
+ Configures your Mac to automatically enable Notifications settings for Santa
+ PayloadDisplayName
+ Santa - Notifications settings
+ PayloadEnabled
+
+ PayloadIdentifier
+ com.northpolesec.santa.notificationsettings.069CA123-6129-46A5-8FD1-49322E5A5755
+ PayloadOrganization
+
+ PayloadRemovalDisallowed
+
+ PayloadScope
+ System
+ PayloadType
+ Configuration
+ PayloadUUID
+ 069CA123-6129-46A5-8FD1-49322E5A5755
+ PayloadVersion
+ 1
+
+
diff --git a/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig
new file mode 100644
index 0000000000..f6cb401a7f
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig
@@ -0,0 +1,36 @@
+
+
+
+
+ PayloadContent
+
+
+ PayloadIdentifier
+ servicemanagement.santa.example.mobileconfig
+ PayloadUUID
+ 0d4e2ece-dfa7-4103-97ff-e91a9f842a1d
+ PayloadType
+ com.apple.servicemanagement
+ Rules
+
+
+ RuleType
+ TeamIdentifier
+ RuleValue
+ ZMCG7MLDV9
+
+
+
+
+ PayloadDisplayName
+ Santa - Service management
+ PayloadIdentifier
+ com.northpolesec.santa.servicemanagement.03cca12c-a610-44c2-96f9-fdabe3acd47d
+ PayloadUUID
+ 03cca12c-a610-44c2-96f9-fdabe3acd47d
+ PayloadType
+ Configuration
+ PayloadScope
+ System
+
+
diff --git a/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig
new file mode 100644
index 0000000000..59f4abba3b
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig
@@ -0,0 +1,65 @@
+
+
+
+
+
+
+ PayloadUUID
+ 40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D
+ PayloadType
+ Configuration
+ PayloadOrganization
+
+ PayloadIdentifier
+ com.northpolesec.santa.system-extension-policy.40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D
+ PayloadDisplayName
+ Santa - System Extensions
+ PayloadDescription
+ Configures your Mac to automatically enable Santa's EndpointSecurityExtension
+ PayloadVersion
+ 1
+ PayloadEnabled
+
+ PayloadRemovalDisallowed
+
+ PayloadScope
+ System
+ PayloadContent
+
+
+ PayloadUUID
+ 98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9
+ PayloadType
+ com.apple.system-extension-policy
+ PayloadOrganization
+
+ PayloadIdentifier
+ com.northpolesec.santa.system-extension-policy.98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9
+ PayloadDisplayName
+ Santa - System extensions
+ PayloadDescription
+
+ PayloadVersion
+ 1
+ PayloadEnabled
+
+ AllowUserOverrides
+
+ AllowedSystemExtensions
+
+ ZMCG7MLDV9
+
+ com.northpolesec.santa.daemon
+
+
+ AllowedSystemExtensionTypes
+
+ ZMCG7MLDV9
+
+ EndpointSecurityExtension
+
+
+
+
+
+
diff --git a/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig
new file mode 100644
index 0000000000..49db6abe22
--- /dev/null
+++ b/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig
@@ -0,0 +1,90 @@
+
+
+
+
+
+ PayloadContent
+
+
+ PayloadDescription
+ Configures Privacy Preferences Policy Control settings
+ PayloadDisplayName
+ Santa - Privacy Preferences Policy Control
+ PayloadIdentifier
+ com.northpolesec.santa.TCC.configuration-profile-policy.2416BA4B-CBFC-4719-B02F-20251B881D6F
+ PayloadOrganization
+
+ PayloadType
+ com.apple.TCC.configuration-profile-policy
+ PayloadUUID
+ 2416BA4B-CBFC-4719-B02F-20251B881D6F
+ PayloadVersion
+ 1
+ Services
+
+ SystemPolicyAllFiles
+
+
+ Allowed
+
+ CodeRequirement
+ identifier "com.northpolesec.santa.daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9
+ Comment
+
+ Identifier
+ com.northpolesec.santa.daemon
+ IdentifierType
+ bundleID
+ StaticCode
+
+
+
+ Allowed
+
+ CodeRequirement
+ identifier "com.northpolesec.santa.bundleservice" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9
+ Comment
+
+ Identifier
+ com.northpolesec.santa.bundleservice
+ IdentifierType
+ bundleID
+ StaticCode
+
+
+
+ Allowed
+
+ CodeRequirement
+ identifier "com.northpolesec.santa" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9
+ Comment
+
+ Identifier
+ com.northpolesec.santa
+ IdentifierType
+ bundleID
+ StaticCode
+
+
+
+
+
+
+ PayloadDescription
+ tcc.configuration-profile-policy.santa.example
+ PayloadDisplayName
+ Santa - TCC configuration
+ PayloadIdentifier
+ com.northpolesec.santa.TCC.configuration-profile-policy.089CBCFB-F2AA-407C-9F2A-A12967FE20BC
+ PayloadOrganization
+
+ PayloadScope
+ System
+ PayloadType
+ Configuration
+ PayloadUUID
+ 089CBCFB-F2AA-407C-9F2A-A12967FE20BC
+ PayloadVersion
+ 1
+
+
diff --git a/it-and-security/lib/macos/scripts/santa-block-script.sh b/it-and-security/lib/macos/scripts/santa-block-script.sh
new file mode 100644
index 0000000000..dcd98d6889
--- /dev/null
+++ b/it-and-security/lib/macos/scripts/santa-block-script.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Define variables
+# Array of SHA256 identifiers to blacklist
+IDENTIFIERS=(
+ # Script2Pkg - just an example, love the app
+ "1096ef7c46e862a8fae75c1a1147b94106b96f009acf8cfd92c9d09c17b1f1e3"
+ # WebEx
+ "8a63cad62a9b1dfcad86b280ec9ad205f08f8bc734311d954e1d451649cb2d93"
+)
+CUSTOM_MSG="This application has been blocked by our security policy."
+SANTACTL="/usr/local/bin/santactl"
+
+# Check if running as root/sudo
+if [ "$EUID" -ne 0 ]; then
+ echo "Error: This script must be run as root or with sudo privileges."
+ exit 1
+fi
+
+# Check if santactl exists at the specified path
+if [ ! -x "$SANTACTL" ]; then
+ echo "Error: santactl not found at $SANTACTL or not executable."
+ exit 1
+fi
+
+# Process each identifier in the array
+for IDENTIFIER in "${IDENTIFIERS[@]}"; do
+ echo "Adding blocking rule for identifier: $IDENTIFIER"
+ "$SANTACTL" rule --blacklist --sha256 "$IDENTIFIER" --message "$CUSTOM_MSG"
+
+ # Verify the rule was added
+ echo "Verifying rule was added..."
+ CHECK_OUTPUT=$("$SANTACTL" rule --check --sha256 "$IDENTIFIER")
+ echo "Rule check output: $CHECK_OUTPUT"
+
+ # Check if the output contains any indication of a rule
+ if [ -n "$CHECK_OUTPUT" ]; then
+ echo "✅ Rule successfully applied for $IDENTIFIER"
+ else
+ echo "❌ Failed to apply rule for $IDENTIFIER"
+ fi
+
+ echo "---------------------------------"
+done
+
+echo "All rule operations completed."
diff --git a/it-and-security/lib/macos/software/santa.yml b/it-and-security/lib/macos/software/santa.yml
new file mode 100644
index 0000000000..597f88fc67
--- /dev/null
+++ b/it-and-security/lib/macos/software/santa.yml
@@ -0,0 +1,4 @@
+url: https://github.com/northpolesec/santa/releases/download/2025.1/santa-2025.1.pkg
+self_service: true
+labels_include_any:
+ - "Santa test device"
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index a19fe72f55..a09b4e5a47 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -90,6 +90,21 @@ controls:
- path: ../lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig
labels_include_any:
- "Macs with 1Password8 installed"
+ - path: ../lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig
+ labels_include_any:
+ - "Santa test device"
+ - path: ../lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig
+ labels_include_any:
+ - "Santa test device"
+ - path: ../lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig
+ labels_include_any:
+ - "Santa test device"
+ - path: ../lib/macos/configuration-profiles/santa-service-management.mobileconfig
+ labels_include_any:
+ - "Santa test device"
+ - path: ../lib/macos/configuration-profiles/santa-notification-settings.mobileconfig
+ labels_include_any:
+ - "Santa test device"
macos_setup:
bootstrap_package: ""
enable_end_user_authentication: false
@@ -135,6 +150,7 @@ queries:
software:
packages:
- path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
+ - path: ../lib/macos/software/santa.yml # Santa for macOS
- path: ../lib/linux/software/zoom-deb.yml # Zoom for Ubuntu
- path: ../lib/linux/software/zoom-rpm.yml # Zoom for RedHat
- path: ../lib/linux/software/slack-deb.yml # Slack for Ubuntu