Feature Request: Additional Variables for EventDetailURL

[manuelnasenspray]

Summary:

I would like to request that more fields be made available for use in the EventDetailURL feature of Santa. Specifically, the following additional variables would be highly useful in constructing URLs for further event investigation:

Requested Fields:

• Application Name: The name of the application that was blocked.
• Application Path: The full path to the blocked application.
• Publisher: The developer or team that signed the application.
• Identifier: A unique identifier for the application (e.g., a hash or other identifying info related to the application).
• Parent Process: The parent process that invoked the blocked application.
These fields would help provide more context about blocked events when linked to external investigation systems or dashboards.

Use Case:

In security environments, knowing the application name, path, publisher, and parent process involved in a blocked event provides additional clarity, especially in automated analysis or when viewing the details in a centralized security management system.

Thank you for considering this feature request!

[pmarkowsky]

There's currently a few options here as documented at https://northpole.dev/deployment/file-access-auth.html#eventdetailurl

Could you elaborate on what you're looking for with these options?

For background, the way Santa was designed the expectation is that Santa redirects to a Sync Service which has more details because Santa's uploaded an Event.

In other words normal operation looks like this.

sequenceDiagram
User ->> Santa: Tries to run a binary and gets blocked
Santa ->> Santa: Santa Blocks a binary and records an event
Santa ->> "Sync Service": Santa Uploads the Event to the Sync Service
"Sync Service" ->> Database: Sync writes event to database
User ->> Santa: user clicks open / request access
Santa ->> "Sync Service": Santa opens the browser and redirects user to page for machine ID and binary combination
"Sync Service" ->> Database: Look up event for details
Database -->> "Sync Service": Present details to user 
"Sync Service" -->> User: Event details / approvals UI

Loading

So the URL is really for you to redirect a browser to a page on your sync service that has more of the details.