#1165 Santa: send events to alert rules and log sinks Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Santa execution events are stored in

santa_events

but don't reach osctrl's existing alerting (webhook/email) or log sinks, so blocks can't page anyone or reach a SIEM. Scope • Emit uploaded Santa events into the logging pipeline as a new log type, so configured log sinks receive them. • Allow alert rules to match Santa events (e.g. decision = BLOCK_*, specific team ID or hash), reusing cooldown/dedupe. • Treat event fields (paths, args, usernames) as untrusted data in notifications. Acceptance • A blocked execution reported by Santa can trigger a webhook alert and appears in a configured log sink. jmpsec/osctrl