---
title: "Events - Workshop Docs"
description: "Events - Enterprise control plane for Santa. Manage rules, approvals, telemetry, and policies across your macOS fleet."
doc_version: "1"
last_updated: "2026-05-22"
canonical: "https://northpole.security/docs/workshop/events"
---
# Events

The Events interface provides visibility into events across your Santa-protected fleet. This feature lets administrators track, analyze, and respond to binary executions throughout your organization.

## Overview

The Events interface displays information about each execution event:

-   **Host Name**: The name of the endpoint where the event occurred
-   **File Name**: The name of the executed binary
-   **Decision**: Whether the execution was allowed or blocked
-   **Reason**: The reason for the decision
-   **Timestamp**: When the execution attempt occurred

## Event Details

Clicking on a file name in the events table opens a detailed view with additional information about the binary:

-   **SHA-256**: The cryptographic hash of the binary
-   **CDHash**: The code directory hash used by macOS for code signing verification
-   **Team ID**: The Apple Developer Team ID associated with the binary
-   **Signing ID**: The signing identity used to sign the binary
-   **Entitlements**: A list of entitlements granted to the binary
-   **First Seen**: When this binary was first observed in your environment

### Creating Rules from Event Details

From the event details page, you can create execution rules directly using the **Create Rule** dropdown. The dropdown lets you pick which identifier type to use (CDHash, Binary SHA-256, Signing ID, Certificate SHA-256, or Team ID) based on the event’s binary.

## Sitemap

- [Home](https://northpole.security/index.md)
- [Workshop](https://northpole.security/workshop.md)
- [Santa](https://northpole.security/santa.md)
- [Features](https://northpole.security/features.md)
- [Cookbook](https://northpole.security/cookbook.md)
- [Docs](https://northpole.security/docs.md)
- [Blog](https://northpole.security/blog.md)
- [Glossary](https://northpole.security/glossary.md)
- [About](https://northpole.security/about.md)
- [Contact](https://northpole.security/contact.md)