---
title: Google Santa fields
description: Santa Module Fields for DISKAPPEAR actions. 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/filebeat/exported-fields-santa
products:
  - Beats
  - Filebeat
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Google Santa fields
Santa Module

## santa

<definitions>
  <definition term="santa.action">
    Action
    type: keyword
    example: EXEC
  </definition>
  <definition term="santa.decision">
    Decision that santad took.
    type: keyword
    example: ALLOW
  </definition>
  <definition term="santa.reason">
    Reason for the decsision.
    type: keyword
    example: CERT
  </definition>
  <definition term="santa.mode">
    Operating mode of Santa.
    type: keyword
    example: M
  </definition>
</definitions>


## disk

Fields for DISKAPPEAR actions.
<definitions>
  <definition term="santa.disk.volume">
    The volume name.
  </definition>
  <definition term="santa.disk.bus">
    The disk bus protocol.
  </definition>
  <definition term="santa.disk.serial">
    The disk serial number.
  </definition>
  <definition term="santa.disk.bsdname">
    The disk BSD name.
    example: disk1s3
  </definition>
  <definition term="santa.disk.model">
    The disk model.
    example: APPLE SSD SM0512L
  </definition>
  <definition term="santa.disk.fs">
    The disk volume kind (filesystem type).
    example: apfs
  </definition>
  <definition term="santa.disk.mount">
    The disk volume path.
  </definition>
  <definition term="santa.certificate.common_name">
    Common name from code signing certificate.
    type: keyword
  </definition>
  <definition term="santa.certificate.sha256">
    SHA256 hash of code signing certificate.
    type: keyword
  </definition>
</definitions>