Skip to main content

Rule Packs

Rule Packs are curated sets of rules, maintained by North Pole Security, that you can subscribe to instead of authoring and maintaining the rules yourself. When you subscribe a tag to a pack, the pack's rules are copied in as ordinary, editable Workshop rules and kept in sync as the pack is updated.

Each pack targets a common need, such as allowing a popular developer toolchain or a well-known vendor's software. You can adopt a vetted baseline quickly and adjust it to fit your environment.

info

Rule Packs are a licensed feature. If you don't see the Packs tab populated on the Rules page, talk to our sales team to get access.

How Rule Packs Work​

When you subscribe a tag to a pack, Workshop materializes each rule in the pack into a normal Workshop rule (an execution, file-access, or package rule, depending on the pack). One copy of each rule is created per tag you subscribe.

Materialized rules are regular Workshop rules in every respect:

  • They appear in the usual rule tables (Execution, File Access, Package, etc.) and are enforced by Santa like any other rule.
  • They can be searched, filtered, and edited.
  • They are scoped to the tag (or tags) you subscribed.

Because the pack's rules become first-class Workshop rules, there is no separate enforcement path to learn. A pack is just a convenient way to add and maintain a set of rules in bulk.

Subscribing to a Rule Pack​

  1. Go to Rules and open the Packs tab.
  2. Browse or search the catalog and find the pack you want.
  3. Click Add on the pack's card.
  4. Choose one or more tags to subscribe. The pack's rules are materialized once under each selected tag.
  5. Confirm with Add Rule Pack.

After subscribing, open the subscription from its card to see the rules the pack created.

Editing Materialized Rules​

We encourage you not to edit rules created by a rule pack. Workshop can recreate or update those rules whenever a pack is added, updated, or removed, so local changes may not stick.

If you do edit a rule created by a rule pack, it loses its provenance: Workshop no longer remembers that the rule came from the pack. The rule keeps existing as a standalone Workshop rule, which may or may not conflict with future rule pack updates.

Keeping a Pack Up to Date​

North Pole Security publishes new versions of packs over time, for example to add coverage for a new release of an application. Workshop periodically checks for new versions and flags a subscription when an update is available.

Updates are always admin-initiated. Workshop never adopts a new version automatically. To apply an update:

  1. Open the subscription that shows Update available.
  2. Review the diff between your current rules and the new version.
  3. Apply the update. Workshop re-materializes the pack's rules to match the new version.

Unsubscribing​

Unsubscribing a tag from a pack removes the subscription and deletes the rules it materialized for that tag, all in a single step. Rules you created yourself are left untouched.

Packs Withdrawn Upstream​

If North Pole Security removes a pack you're subscribed to, the subscription is marked No longer available. The rules it already materialized keep enforcing and are never silently dropped, but updates are disabled. Unsubscribe if you no longer need those rules.

Auditing​

Subscribing, applying an update, and unsubscribing each record audit events, including per-rule events linked to the action, so you have a complete trail of how a pack changed your rules. See Audit for more on audit events.