#1176 Santa: retrieve a binary from a host for analysis Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Analysts sometimes need the actual binary that was blocked. Workshop uploads it to a bucket. Scope • From an event or binary view, start an osquery file carve of the event's path on that node, reusing existing carve permissions and storage. • Show carve status next to the event. Acceptance • Uses existing carve authorization; no new upload path on

osctrl-tls

. jmpsec/osctrl