santa icon indicating copy to clipboard operation
santa copied to clipboard

`santactl rule` should allow clearing ruleset

Open russellhancox opened this issue 4 months ago • 0 comments

Discussed in https://github.com/google/santa/discussions/1292

Originally posted by jumpsdefcon February 14, 2024 So, was doing some testing with an agent that is not using a sync server, and was looking to manual import the json rule list. I got the list to import fine, but when I try to import a different rule list I still see the full list of rules in the database. Do I need to script out a removal line by line and then re-import the new list or perhaps script removal and reinstall of the agent?

I would have expected the import to purge the current list and then import the rules in the new config file.

We should add a --clean flag that can both delete all rules on its own or clean before importing new when combined with the --import flag.

russellhancox avatar Feb 14 '24 17:02 russellhancox