How do I convert from an indentifier to a path?

[e40]

I do not use a server. I'm using

santad          | 2024.9 (build 674285143)
santactl        | 2024.9 (build 674285143)
SantaGUI        | 2024.9 (build 674285143)

I export with santactl rule --export rules.json and in the JSON output I see a lot of items like this:

    {
      "custom_msg" : "",
      "rule_type" : "BINARY",
      "identifier" : "4b8cfd2d25e9818e778205fd83d17af1a83a217d0f67fbf5f776ef81c6157947",
      "custom_url" : "",
      "policy" : "BLOCKLIST"
    },

How do I convert that to a specific path? It's been so long since I added them I've forgotten.

It would be really nice to know the answer, but I will say moving forward, what I'm doing is adding a --message "..." to my rule --block commands that tells what the name of the application is. This will allow me to identify future uses, when I export them.

In fact, what I did was do a recursive fileinfo and tried to find those identifiers in the output and couldn't, so I just removed them with santactl. So, I'm fine if this is closed, but I would recommend it be documented how to do what I wanted, since I'm sure others will have the same question.

[russellhancox]

How do I convert that to a specific path? It's been so long since I added them I've forgotten.

Right now, you can't, at least not with Santa itself.

I searched for the hash in VirusTotal and it looks like this is Apple Music

It would be really nice to know the answer, but I will say moving forward, what I'm doing is adding a --message "..." to my rule --block commands that tells what the name of the application is. This will allow me to identify future uses, when I export them.

This is a good idea, though overloading the message field is a bit weird. I think we should turn this into an Issue and add a new field to rules for free-form comments. When you add rules with santactl rule we can add a flag so you can provide a comment and if you don't, we'll make a reasonable default (from some combination of a signing ID or the original file path).

[russellhancox]

We've opened #112 to track this