--- title: "Announcing Santa & Workshop 2026.6" description: "Santa and Workshop 2026.6 add network rules, privilege management, Signals, webhooks, a redesigned Ready for Lockdown report, and more" doc_version: "1" last_updated: "2026-07-24" canonical: "https://northpole.security/blog/release-20266" --- [Back](https://northpole.security/blog) Releases • July 10, 2026 • By Matthew White & Russell Hancox ![Announcing Santa & Workshop 2026.6](https://northpole.security/images/blog/release-2026.6/release-2026.6-hero.jpg) ![](https://northpole.security/images/home/divider-band-top.svg) [Santa v2026.6](https://github.com/northpolesec/santa/releases/tag/2026.6) and [Workshop 2026.6](https://northpole.security) are available now, and together they make up the largest release we’ve shipped for either product. Three major capabilities span the agent and the console: network rules that bring application-level firewalling to the endpoint, privilege management that replaces standing admin rights with on-demand elevation, and Signals that turn host telemetry into near-realtime detections. Santa enforces and observes on the host. Workshop is where you define the policy and work the results. Alongside those, this release adds webhooks, a redesigned Ready for Lockdown report, faster AI chat, and a long list of smaller improvements on both sides. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## Network Rules (Beta) Santa already controls which binaries can run and which processes can access protected files, and it produces a detailed record of activity across the host. In 2026.6, that control extends to the network. Network rules bring application-level firewalling to Santa, managing both outgoing and incoming connections with the same rule model you already use for execution and file access. ### How It Works A network rule pairs a target with a decision. Santa can allow the matching activity, block it, or audit it. An audit decision lets the activity proceed but emits an event to Workshop, so you get a record of the connection without interrupting the user. A rule can apply broadly to all traffic, or be scoped to specific processes, identified the same way you identify binaries everywhere else in Santa: by Signing ID, Team ID, or CDHash. On the network side, a rule can match on: - **Hostname, domain, or IP range.** Allow a specific service, an entire domain, or a CIDR range. - **Port or port range.** Scope a rule to a single port or a contiguous range. - **Protocol.** Apply policy by connection protocol. - **Direction.** Target outbound or inbound connections. Rather than trusting a binary everywhere it runs, you decide exactly what it is allowed to talk to. When Santa blocks a flow, the user isn’t left guessing. The block surfaces in the Santa GUI as a notification dialog, and Santa can also write the reason to the controlling TTY for command-line tools. As with execution blocks, each rule can carry its own custom message and URL, so you can point users to an internal help page or explain why a connection was denied. Every decision is recorded in telemetry, including the remote hostname a flow was headed to, the rule that matched, and the decision Santa made. In Workshop, network rules live alongside the rest of your configuration, versioned and auditable, and matched activity shows up in your network activity view. It’s clear not just that a connection happened, but why it was allowed or blocked. ### Use Cases - **Watch before you block.** Audit a rule to see the activity it would catch, then switch it to block once you’re confident it won’t disrupt users. - **Lock a tool to a single destination.** Allow a developer tool to reach your internal package registry and nothing else, or pin a backup agent to one storage endpoint. - **Stop a process from beaconing out.** Prevent a compromised or curious process from reaching an attacker-controlled host, even one you otherwise allow to run. - **Contain lateral movement.** Deny unexpected inbound connections to shrink the network attack surface of every managed host. **Note:** Network rules are in beta and require **Santa 2026.6** and **Workshop 2026.6**. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## Endpoint Privilege Management (Beta) Standing administrator access is one of the most common and most abused sources of endpoint risk. Users who only occasionally need admin access often hold it permanently, which leaves privilege in place for malware or an attacker to abuse. Endpoint Privilege Management lets you remove that standing privilege and grant it only when it’s actually needed. ### How It Works With Endpoint Privilege Management enabled, a standing administrator is demoted to a standard user. When that user needs admin access, they request temporary elevation from the Santa menu bar or with the `santactl adminmode` command, and provide a justification. Santa grants admin rights for a limited window, then automatically revokes them when the window expires or the user’s console session ends. Elevation is never permanent, and it never lingers past the session. Every elevation is audited. Santa records who elevated, when, and the justification they gave, and uploads those audit events to Workshop, so administrators keep a complete record of privileged access. Users can check their current state at a glance from the User Type line in the Santa menu. ### Use Cases - **Eliminate standing admin.** Give users the administrative access they occasionally need without leaving admin rights in place the rest of the time. - **Audit privileged access.** Keep a complete, centralized record of every elevation and the justification behind it. - **Reduce attack surface.** Shrink the window in which admin rights exist on a host, limiting what a compromise can take advantage of. **Note:** Endpoint Privilege Management is in beta and requires **Santa 2026.6** and **Workshop 2026.6**. We’ll be making usability improvements in upcoming releases. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## Signals Santa already generates a detailed record of what happens on a host. Signals turn that record into near-realtime detection. Instead of exporting telemetry and querying it after the fact, you define conditions that Santa evaluates on the endpoint the moment events are written, and matches surface in Workshop without delay. ### How It Works Signal definitions are managed in Workshop and synced down to each host, where Santa evaluates them as activity happens. When a signal matches, Santa reports it to Workshop, where it appears as a task with an owner and a lifecycle. You can assign a signal to a team member and track its state as it moves through your investigation pipeline, so an alert becomes a piece of work rather than a line in a log. Signals carry free-form labels for however your team categorizes and filters alerts. Add a MITRE ATT&CK technique number as a label and Workshop links it automatically to the technique description on MITRE’s site, so whoever is triaging can jump straight to the reference for the behavior it represents. This is an early release. Today a signal evaluates a single event at a time. Upcoming releases will expand that to sliding windows, correlation across multiple events, and process trees, so you can express far richer detections. ### Use Cases - **Detect known-bad behavior.** Flag activity that matches your detections the moment it happens on the host. - **Work alerts, don’t just read them.** Assign each signal to an owner and track it to resolution inside Workshop. - **Map to a framework.** Tag signals with MITRE ATT&CK techniques and jump straight to the reference while triaging. **Note:** Signals require **Santa 2026.6** and **Workshop 2026.6**. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## More in Workshop 2026.6 ### Webhooks Workshop can now send webhooks in response to key activity, making it easier to wire Workshop into the systems your team already uses. Rather than polling the API or exporting data on a schedule, Workshop pushes events to you the moment they happen. In this release, webhooks can fire: - When an **audit event** is emitted, giving you a live feed of configuration and administrative changes as they occur. - When a **Signal is created or changes state**, so your alerting and case-management tooling stays in step with Workshop. - The **first time a piece of software is approved**, a natural hook for change-management records, notifications, or downstream automation. This opens the door to ticketing systems, chat notifications, SIEMs, and custom automations without building and maintaining a polling layer of your own. Post to Slack when a new app is approved, open a ticket when a Signal fires, or forward audit events into your log pipeline. We’ll add more webhook triggers in future releases. ### Redesigned Ready for Lockdown Report (Beta) Lockdown mode is where Santa’s protection is at its strongest, but getting a tag ready for it has always been the hard part. You need confidence that everything your users legitimately run is already accounted for before you flip the switch. We’ve rebuilt the Ready for Lockdown report from the ground up to make that path far clearer. The redesigned report shows at a glance which tags are approaching the point where they can safely move into lockdown, and exactly what stands between each tag and that goal. It helps you create the rules that move the needle, turning what used to be a guessing game into a concrete, actionable checklist. You can watch a tag get closer to lockdown-ready as you work through it, and see the impact of each rule you add. This is an early release of the redesigned report, and we’d genuinely love your feedback. We’ll keep improving it in upcoming releases. ### AI Chat and MCP Improvements Chat with Workshop and our MCP integration have quickly become two of the most-used ways people work with their fleet data. This release makes both faster and more efficient. We reworked how the AI layer discovers and invokes Workshop’s tools, cutting the round-trips needed to answer a question, and improved caching across the integration. The result is a noticeably snappier experience. Questions come back faster, multi-step investigations feel more fluid, and because we reuse cached context far more effectively, the whole thing consumes fewer tokens. That means lower cost for the API keys you bring and more headroom to ask follow-up questions. These improvements apply to both the in-app chat and Workshop’s MCP server. ### Additional Improvements - **Rule Packs.** Subscribe to curated rule sets provided by North Pole Security. There are a few packs to get started with, and more are coming over the next month.. - **Dynamic sync jitter.** Jitter applied to push-triggered sync commands is now dynamic and tighter, and is often not applied at all, so hosts act on push commands faster. - **Automated app inventory.** Workshop will now, by default, automatically trigger Santa to upload details about bundles that are unknown to Workshop when executed in monitor mode. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## More in Santa 2026.6 ### Relative Time in CEL CEL policies can now call `today()` and `days(X)`, so a policy can reason about time relative to the moment it runs rather than against a hardcoded date. Paired with a timestamp on the binary, such as its code signing time, this lets a rule change behavior as time passes without ever being edited. For example, this policy allows a binary only when it was signed within the last 90 days, and blocks anything older: ``` target.secure_signing_time > today() - days(90) ? ALLOWLIST : BLOCKLIST ``` That is a simple way to ensure users are running new or recently updated software. Once a build’s signature ages past your threshold, it stops being allowed, nudging the fleet onto current versions. Swap the result to `AUDIT` to see which hosts are running stale software before you enforce. You can also allow a piece of software to run only for a limited time, say, until a license expires: ``` today() < timestamp("2026-07-10T10:00:00.000Z") ? ALLOWLIST : BLOCKLIST ``` **Note**: Relative time in CEL requires **Santa 2026.6** and **Workshop 2026.6**. ### Additional Improvements - **Finer-grained silent blocks.** New `SILENT_GUI_BLOCKLIST` and `SILENT_TTY_BLOCKLIST` policies silence a block in just the GUI or just the TTY, rather than everywhere like `SILENT_BLOCKLIST`. Both still enforce the block, and only the notification changes. - **Telemetry event IDs.** Protobuf telemetry now includes an opaque, unique `event_id` on every message, making it easier to deduplicate and correlate events in downstream pipelines. ![](https://northpole.security/images/home/divider-band-bottom.svg) ## Getting Santa and Workshop 2026.6 Santa 2026.6 is available now on [GitHub](https://github.com/northpolesec/santa/releases/tag/2026.6), with deployment guidance in the [getting started guide](https://northpole.dev/deployment/getting-started/). Workshop 2026.6 is available now to all Workshop customers. As always, we welcome your feedback and suggestions for future improvements. Santa Workshop Releases Network Rules Privilege Management Signals Webhooks ## You may also like [ ![Announcing Santa 2026.5](https://northpole.security/images/blog/santa-2026.5-hero.jpg) Releases • June 8, 2026 Announcing Santa 2026.5 Santa 2026.5 adds sandbox profile rules, on-demand binary upload, CEL audit policies, and CEL fallback coverage for platform binaries. ](https://northpole.security/blog/santa-20265)[ ![Announcing Workshop 2026.5](https://northpole.security/images/blog/workshop-2026.5-hero.jpg) Releases • June 8, 2026 Announcing Workshop 2026.5 Workshop v2026.5 introduces Seatbelt Rules in beta, multiparty approval on any method, a redesigned filter bar, and much more! ](https://northpole.security/blog/workshop-20265)[ ![Announcing Santa 2026.4](https://northpole.security/images/blog/santa-2026.4-hero.jpg) Releases • May 20, 2026 Announcing Santa 2026.4 Santa 2026.4 expands tamper resistance, changes clean sync semantics, adds silenceable device notifications, and continues security hardening. ](https://northpole.security/blog/santa-20264) ## Sitemap - [Home](https://northpole.security/index.md) - [Workshop](https://northpole.security/workshop.md) - [Santa](https://northpole.security/santa.md) - [Features](https://northpole.security/features.md) - [Cookbook](https://northpole.security/cookbook.md) - [Docs](https://northpole.security/docs.md) - [Blog](https://northpole.security/blog.md) - [Glossary](https://northpole.security/glossary.md) - [About](https://northpole.security/about.md) - [Contact](https://northpole.security/contact.md)