Santa’s SyncBaseURL configuration flag allows you to synchronize with a management server, which uploads events that have occurred on the machine and downloads new rules.
There are several open-source servers you can sync with:
- Moroz: A simple golang server that serves hard-coded rules from configuration files.
- Rudolph: An AWS-based serverless sync service primarily built on API GW, DynamoDB, and Lambda components to reduce operational burden. Rudolph is designed to be fast, easy-to-use, and cost-efficient.
- Zentral: A centralized service that pulls data from multiple sources and deploys configurations to multiple services.
- Zercurity: A dockerized service for managing and monitoring applications across a large fleet using Santa + Osquery.
santactl can configure rules locally without a sync server.
See the Syncing Overview page for an explanation of how syncing works in Santa.