santa
santa copied to clipboard
`santactl rule` should allow clearing ruleset
Discussed in https://github.com/google/santa/discussions/1292
Originally posted by jumpsdefcon February 14, 2024 So, was doing some testing with an agent that is not using a sync server, and was looking to manual import the json rule list. I got the list to import fine, but when I try to import a different rule list I still see the full list of rules in the database. Do I need to script out a removal line by line and then re-import the new list or perhaps script removal and reinstall of the agent?
I would have expected the import to purge the current list and then import the rules in the new config file.
We should add a --clean
flag that can both delete all rules on its own or clean before importing new when combined with the --import
flag.