Skip to main content

Hosts

The Hosts interface provides a comprehensive view of all endpoints running Santa across your organization. This centralized dashboard allows administrators to monitor, manage, and troubleshoot Santa deployments at scale.

Overview​

The Hosts dashboard displays information about each endpoint:

  • Hostname: The hostname of the endpoint
  • Mode: Current mode of the Santa agent (learn more about modes)
  • OS Version: Operating system version information with indicators for outdated versions
  • Santa Version: Version of the Santa agent
  • Last Sync: Time of last communication with the sync server

Host Details​

Clicking on an individual host provides detailed information:

  • Host Details: Hostname, UUID, primary user, hardware model, serial number, OS version/build, and Santa version with update indicators
  • Client Mode: Current enforcement mode (Monitor, Lockdown, or Standalone) with ability to change settings
  • Sync Information: Last sync time, rule sync time, last preflight and postflight times
  • Sync Controls: Options to trigger immediate sync or perform a clean sync
  • OS Updates: Indicators when updates are available for the operating system
  • Santa Updates: Indicators when newer Santa versions are available

Changing Client Modes​

To change the mode of a host, click the "Change Mode" button and select the desired mode.

warning

Changing the mode of a host will immediately impact the behavior of the Santa agent on that host. This can cause disruption to users if not done carefully.

Syncing Hosts​

Hosts can be synced manually or automatically.

  • Manual Sync: Click the "Sync Now" button to force a sync of the host
  • Clean Sync: Click the "Clean Sync" button to force a clean sync of the host.
warning

A clean sync will take a long time to complete and should only be done when necessary.

Machine ID Changes​

If your organization changes the format used for machine IDs (e.g. using the MachineID key in Santa), Workshop will attempt to match the new machine ID to an existing host record. If a machine syncs with a new ID but has the same hardware model identifier, serial number, and primary user as an existing host, the existing record will be updated with the new ID rather than creating a duplicate entry. This avoids double-counting hosts in most cases.

However, if any of those fields differ — for example, if the primary user changed at the same time as the machine ID — Workshop will treat the endpoint as a new host. The old host entry will remain visible for 30 days before it is automatically removed. During this window the same physical machine will be counted twice.

Deleting Hosts​

Hosts can be manually deleted. This will immediately delete all data about this host from the database but will leave events for that host in the events table.