v2026.6

Notes

Tip

See it in action. Watch demo videos and walk through examples of the major features in our release blog post: northpole.security/blog/release-20266.

Announcements

🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security's official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

❗ Fixed regression with compiler rules that could prevent Santa from generating transitive rules

Changed

↔️ When using protobuf, protobuf variants, and JSON EventLogType values, when a spool is filled, the oldest files are now evicted instead of dropping the newest events.
↔️ Workshop customers: Network activity telemetry now includes hostname, and rule match information

Added

➕ Support for new rule policies SILENT_GUI_BLOCKLIST and SILENT_TTY_BLOCKLIST to allow more fine-grained silencing options over the existing SILENT_BLOCKLIST
➕ santactl doctor now checks certificate validity
➕ protobuf telemetry now contains an opaque unique identifier event_id per-message
➕ Workshop customers: On device telemetry scanning, EDR signals
➕ Workshop customers: Network rule support to enable blocking/allowing network activity
➕ Workshop customers: Endpoint Privilege Management (EPM) support to further lock down endpoints by limiting access to admin and sudo privileges
➕ Workshop customers: CEL policies now have access to today() and days(X) functions to support relative time checks
➕ Workshop customers: New sandbox policy placeholder variable support: BINARY_PATH

---

The Santa Lite package is rarely the right choice. Install the standard package unless you have a specific reason not to. Workshop customers should not install lite since it omits many features. See the lite package documentation for details. Download at: santa-2026.6-lite.pkg.

Santa documentation can be found at northpole.dev.

What's Changed

• Proactively Lockdown permissions on labeler.yml by @pmarkowsky in #998
• santactl/sandbox: Add BINARY_PATH placeholder by @russellhancox in #1000
• santactl: Make doctor print cert validity by @russellhancox in #999
• Remove Polaris by @russellhancox in #997
• santad: Remove stats-state.plist from tamper protection by @russellhancox in #1002
• Bump docs dependency by @mlw in #1004
• Testing/Fuzzing: add KernelCsBlobFuzzer by @mlw in #1003
• Bump docs dependency by @mlw in #1005
• deps: Update esbuild by @russellhancox in #1006
• common: add ProcessID for pid+pidversion process identity by @mlw in #1007
• common: put PassKey in santa namespace by @mlw in #1008
• telemetry: Add event_id to proto schema, populate by @russellhancox in #1010
• Don't clear the compiler PID mark on a pidversion mismatch by @mlw in #1012
• docs: update build deps by @mlw in #1013
• docs: update build deps by @mlw in #1015
• santad: Add today() and days() functions to CELv2 context by @russellhancox in #1014
• santad: Add SILENT_GUI_BLOCKLIST and SILENT_TTY_BLOCKLIST support by @russellhancox in #1016
• common: Add AuditTokenFromData and rewrite ProcessID::FromTokenData on top of it by @mlw in #1018
• cel: Update caching of fallback rules, prevent UNSPECIFIED in non-fallback by @russellhancox in #1017
• ci: make labeler job non-blocking by @tburgin in #1021
• test: Significantly speed-up some slower tests by @russellhancox in #1023
• Use name as the primary key for network flow rules by @tburgin in #1022
• santad: Evict oldest spool files when full & add spool metrics by @russellhancox in #1020
• santad: Sync detection signals into the rules database; add Sleigh signal-scan-support by @russellhancox in #1024
• Relax FAA rule name validation to allow resource-style names by @tburgin in #1025
• add support for SyncRequest.max_jitter by @tburgin in #1027
• common: Extract SNTStoredProcess from SNTStoredFileAccessEvent by @mlw in #1028
• common: Add SNTStoredNetworkFlowEvent by @mlw in #1029
• santad: Ingest network flow decisions reported by santanetd by @mlw in #1030
• santad: Store signal reports and upload them to the sync server by @russellhancox in #1026
• santasyncservice: Upload network flow events to the sync server by @mlw in #1031
• gui: Add a notification dialog for blocked network flows by @mlw in #1032
• build: scope dSYM generation to release builds; drop dead test code by @mlw in #1033
• common: add Temporary Admin Mode policy, audit events, and config plumbing by @sharvilshah in #1034
• gui: Honor per-rule custom messages and URLs for blocked network flows by @mlw in #1040
• santad: extract shared TimedSyncSession base and refactor TMM onto it by @sharvilshah in #1035
• sync: Temporary Admin Mode policy and upload audit events by @sharvilshah in #1036
• santad: add Temporary Admin Mode by @sharvilshah in #1037
• santad: revoke Temporary Admin Mode on console-session leave by @sharvilshah in #1039
• santad: write network-flow block message to the controlling TTY by @mlw in #1041
• common: add token-validated csops helpers (csops_audittoken) by @mlw in #1043
• santad: fix out-of-bounds read in SleighLauncherTest by @mlw in #1046
• Add remote_hostname field to NetworkActivity.Flow by @mlw in #1047
• santactl: add adminmode command and report user type in status by @sharvilshah in #1044
• santasyncservice: support repeated paths in EventUpload command by @tburgin in #1048
• santad: demote and restore admins with Temporary Admin Mode by @sharvilshah in #1045
• gui: add TMM/TAM separator and User Type line to status menu by @sharvilshah in #1049
• santad: fix BOOL-to-bool narrowing in AdminGroupMembership member list by @sharvilshah in #1051
• Bump dependencies by @russellhancox in #1050
• gui: fix rare status-menu crash by running daemon-pushed timed-mode updates on main thread by @sharvilshah in #1052
• gui: better TAM justification prompt presentation by @sharvilshah in #1053
• sync: Disable telemetry export when config is revoked by @russellhancox in #1054
• Add evaluation decision fields to NetworkActivity.Flow by @mlw in #1055
• deps: Update protos dep by @russellhancox in #1056
• santactl/status: Correctly report telemetry export status by @russellhancox in #1057
• santactl: Report export status via santad by @russellhancox in #1058
• santad: Don't log a warning if Sleigh is missing by @russellhancox in #1059

Full Changelog: 2026.5...2026.6