SANTAMON

Summary from the TLDR InfoSec newsletter

Santamon is an experimental macOS detection sidecar for Santa that evaluates Endpoint Security telemetry locally using CEL rules. It forwards only matched detections to a backend while keeping raw telemetry on-device. Santamon leverages Santa's existing ESF sensor capabilities, avoiding Apple entitlement requirements. It adds three detection rule types: simple matching, time-window correlation, and baseline (first-seen) tracking with optional process tree enrichment.