---
title: "Rule Packs - Workshop Docs"
description: "Rule Packs - Enterprise control plane for Santa. Manage rules, approvals, telemetry, and policies across your macOS fleet."
doc_version: "1"
last_updated: "2026-07-16"
canonical: "https://northpole.security/docs/workshop/rules/rule-packs"
---
# Rule Packs

Rule Packs are curated sets of rules, maintained by North Pole Security, that you can subscribe to instead of authoring and maintaining the rules yourself. When you subscribe a tag to a pack, the pack’s rules are copied in as ordinary, editable Workshop rules and kept in sync as the pack is updated.

Each pack targets a common need, such as allowing a popular developer toolchain or a well-known vendor’s software. You can adopt a vetted baseline quickly and adjust it to fit your environment.

## How Rule Packs Work

When you subscribe a tag to a pack, Workshop **materializes** each rule in the pack into a normal Workshop rule (an execution, file-access, or package rule, depending on the pack). One copy of each rule is created per tag you subscribe.

Materialized rules are regular Workshop rules in every respect:

-   They appear in the usual rule tables (Execution, File Access, Package, etc.) and are enforced by Santa like any other rule.
-   They can be searched, filtered, and edited.
-   They are scoped to the tag (or tags) you subscribed.

Because the pack’s rules become first-class Workshop rules, there is no separate enforcement path to learn. A pack is just a convenient way to add and maintain a set of rules in bulk.

## Subscribing to a Rule Pack

1.  Go to **Rules** and open the **Packs** tab.
2.  Browse or search the catalog and find the pack you want.
3.  Click **Add** on the pack’s card.
4.  Choose one or more tags to subscribe. The pack’s rules are materialized once under each selected tag.
5.  Confirm with **Add Rule Pack**.

After subscribing, open the subscription from its card to see the rules the pack created.

## Editing Materialized Rules

We encourage you not to edit rules created by a rule pack. Workshop can recreate or update those rules whenever a pack is added, updated, or removed, so local changes may not stick.

If you do edit a rule created by a rule pack, it loses its provenance: Workshop no longer remembers that the rule came from the pack. The rule keeps existing as a standalone Workshop rule, which may or may not conflict with future rule pack updates.

## Keeping a Pack Up to Date

North Pole Security publishes new versions of packs over time, for example to add coverage for a new release of an application. Workshop periodically checks for new versions and flags a subscription when an update is available.

Updates are always **admin-initiated**. Workshop never adopts a new version automatically. To apply an update:

1.  Open the subscription that shows **Update available**.
2.  Review the diff between your current rules and the new version.
3.  Apply the update. Workshop re-materializes the pack’s rules to match the new version.

## Unsubscribing

Unsubscribing a tag from a pack removes the subscription and deletes the rules it materialized for that tag, all in a single step. Rules you created yourself are left untouched.

## Packs Withdrawn Upstream

If North Pole Security removes a pack you’re subscribed to, the subscription is marked **No longer available**. The rules it already materialized keep enforcing and are never silently dropped, but updates are disabled. Unsubscribe if you no longer need those rules.

## Auditing

Subscribing, applying an update, and unsubscribing each record audit events, including per-rule events linked to the action, so you have a complete trail of how a pack changed your rules. See [Audit](https://northpole.security/docs/workshop/audit) for more on audit events.

## Sitemap

- [Home](https://northpole.security/index.md)
- [Workshop](https://northpole.security/workshop.md)
- [Santa](https://northpole.security/santa.md)
- [Features](https://northpole.security/features.md)
- [Cookbook](https://northpole.security/cookbook.md)
- [Docs](https://northpole.security/docs.md)
- [Blog](https://northpole.security/blog.md)
- [Glossary](https://northpole.security/glossary.md)
- [About](https://northpole.security/about.md)
- [Contact](https://northpole.security/contact.md)