Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Stripe + Fleet
Stripe moved 10,000 Macs to Fleet, saving hundreds of thousands annually
Foursquare + Fleet
Foursquare quickly migrates to Fleet for device management.
Faire + Fleet
Faire secures Macs with CIS benchmarks and Fleet
What people are saying
Stories from the Fleet community.
Pricing
More
Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
santa_status
santa_status
The output of santactl status --json showing current Santa statistics and configuration.
| Column | Type | Description |
|---|---|---|
| binary_rules | integer | Binary rules count |
| block_usb | integer | Block USB enabled (1=true, 0=false) |
| cdhash_rules | integer | CDHash rules count |
| certificate_rules | integer | Certificate rules count |
| compiler_rules | integer | Compiler rules count |
| events_pending_upload | integer | Events pending upload |
| file_logging | integer | File logging enabled (1=true, 0=false) |
| log_type | text | Log type (e.g., file) |
| metrics_enabled | integer | Metrics enabled (1=true, 0=false) |
| metrics_export_interval_seconds | integer | The metrics export frequency in seconds. |
| metrics_server | integer | The address of the server Santa sends metrics to. |
| mode | text | Santa mode (e.g., Monitor) |
| non_root_cache_count | integer | Non-root cache count |
| on_start_usb_options | text | USB options on start |
| remount_usb_mode | text | Remount USB mode |
| root_cache_count | integer | Root cache count |
| signingid_rules | integer | Signing ID rules count |
| static_rule_count | integer | Static rule count |
| sync_bundle_scanning | integer | Whether Santa scans and evaluates entire application bundles during sync (1=true, 0=false) |
| sync_clean_required | integer | Whether a full clean sync is required before Santa can resume normal operation (1=true, 0=false) |
| sync_enabled | integer | Whether Santa is configured to sync with a remote server (1=true, 0=false) |
| sync_execution_rules_hash | text | Hash of the currently applied file access ruleset |
| sync_file_access_rules_hash | text | Hash of the currently applied execution ruleset |
| sync_last_successful_full | text | Timestamp of the last successful full sync |
| sync_last_successful_rule | text | Timestamp of the last successful rules-only sync |
| sync_push_notifications | text | Whether push notifications are enabled to trigger immediate syncs |
| sync_server | text | The server Santa syncs rules and configuration from |
| teamid_rules | integer | Team ID rules count |
| transitive_rules_count | integer | Transitive rules count |
| transitive_rules_enabled | integer | Transitive rules enabled (1=true, 0=false) |
| watch_items_config_path | text | Path to the configuration file that defines watch items |
| watch_items_data_source | text | Source of the watch items policy (for example, local file or synced server policy) |
| watch_items_enabled | integer | Watch items enabled (1=true, 0=false) |
| watch_items_last_policy_update | text | Timestamp of the last time the watch items policy was updated |
| watch_items_policy_version | text | Version of the currently applied watch items policy |
| watch_items_rule_count | text | Number of active watch item rules currently enforced |
| watchdog_cpu_events | integer | Number of watchdog CPU events |
| watchdog_cpu_peak | double | Peak CPU usage |
| watchdog_ram_events | integer | Number of watchdog RAM events |
| watchdog_ram_peak | double | Peak RAM usage |
Example
Confirm Santa is running in lockdown mode across all macOS hosts.
SELECT mode FROM santa_status;Questions?
SOC2 Type 2
