Skip to main content

Data Sharing

Data sharing helps you decide if an application is safe to allow. When you know that many other organizations run an application, or that many block it, you can judge its risk faster. To make this possible, organizations that turn on data sharing send North Pole Security information about the binaries that run in their fleet. North Pole Security combines the data from all organizations that share.

note

Data sharing has no effect yet. You can turn it on and set a filter now, but Workshop does not send any data yet. A later release of Workshop will start to send data, and will show you the results.

Turn on data sharing​

Data sharing is off by default. Two switches must be on before Workshop can share data:

  1. North Pole Security turns on data sharing for your organization. Talk with us to get access.
  2. An administrator turns on Share application data in Settings → Data Sharing and clicks Save Settings.

If data sharing is not available for your organization, the settings page shows a warning. You cannot turn data sharing on or change the filter, but you can turn data sharing off. Either side can turn data sharing off at any time.

What Workshop shares​

For each binary, Workshop shares:

  • The file name, SHA-256 hash, signing ID, and team ID of the binary.
  • The name, version, and hash of the bundle that contains the binary, if there is one.
  • How many times the binary was allowed and blocked, and how many hosts allowed it.
  • If your rules block the binary as malware or because of your policy.
  • The day, and the kinds of rules that allowed or blocked the binary: binary hash, CDHash, signing ID, certificate, or team ID.

Workshop does not share exact counts. It reports each count as a range: 1, 2, 5, 10, 20, 50, 100, 200, 500, or 1,000 and more.

Workshop does not share host names, user names, serial numbers, or file paths. The data does not include the name of your organization. Workshop sends a random ID in its place. This ID stays the same for your organization. North Pole Security operates the service that receives the data, so it can still tell which organization sent it.

Keep binaries private​

Use a filter to keep binaries out of the shared data. For example, use it for applications that your organization develops. Binaries that match the filter are not shared.

Enter a CEL expression that returns true for binaries you want to keep private. For example, to keep the binaries that your organization signs private:

blockable.team_id == "YOURTEAMID"

The filter can inspect only blockable (the binary) and bundle (its bundle). For example, use blockable.signing_id or bundle.bundle_id to match an application. Host and user data are not available. Leave the filter blank to add no exclusions.

Workshop rejects invalid expressions and expressions that do not return a boolean. Click Save Settings to save both the switch and the filter.