How do I convert from an indentifier to a path?

[e40]

I do not use a server. I'm using

santad          | 2024.9 (build 674285143)
santactl        | 2024.9 (build 674285143)
SantaGUI        | 2024.9 (build 674285143)

I export with santactl rule --export rules.json and in the JSON output I see a lot of items like this:

    {
      "custom_msg" : "",
      "rule_type" : "BINARY",
      "identifier" : "4b8cfd2d25e9818e778205fd83d17af1a83a217d0f67fbf5f776ef81c6157947",
      "custom_url" : "",
      "policy" : "BLOCKLIST"
    },

How do I convert that to a specific path? It's been so long since I added them I've forgotten.

Thanks.

[e40]

It would be really nice to know the answer, but I will say moving forward, what I'm doing is adding a --message "..." to my rule --block commands that tells what the name of the application is. This will allow me to identify future uses, when I export them.

In fact, what I did was do a recursive fileinfo and tried to find those identifiers in the output and couldn't, so I just removed them with santactl. So, I'm fine if this is closed, but I would recommend it be documented how to do what I wanted, since I'm sure others will have the same question.

[russellhancox]

You're welcome to wait for someone at Google to respond to this issue but the original Santa team has moved over to a new repository. If you'd like to re-open your issue/discussion at https://github.com/northpolesec/santa, we'd be happy to help you out there