esloggerThe family behind every Mac EDR tool — and a built-in command that lets you watch the kernel narrate process launches in real time.
exec events on your Mac with Apple's pre-entitled eslogger, no entitlement required.Your content filter from Lessons 2–6 watches network flows. Endpoint Security (ES) watches system events — every process that launches, file that opens, mount, signal, fork. It's how Mac Monitor (already running on your Mac) and tools like CrowdStrike, SentinelOne, and Jamf Protect see what's happening.
ES is a C API. You create a client, subscribe to event types, and a handler fires for each event. Two flavours of event:
| Kind | What you can do | Example |
|---|---|---|
| NOTIFY | Observe only — the event already happened. | "process /usr/bin/curl launched" → log it. |
| AUTH | Gate it — the kernel blocks until you return ALLOW or DENY. | "about to exec this binary" → deny if it's malware. |
That AUTH power — synchronously vetoing an exec or open — is exactly what KAUTH kexts used to do in the kernel. ES moved it to a sandboxed user-space process. The skeleton in C:
ES requires com.apple.developer.endpoint-security.client — a restricted entitlement granted only via Apple's System Extensions request form (they vet your company/use-case). Unlike the Network Extension capability you self-served in Lesson 5, there's no portal toggle. Plus the client needs Full Disk Access. This is the wall we flagged in Lesson 1.
esloggerYou can't ship an ES client without Apple's nod, but macOS includes eslogger — Apple's own, fully-entitled ES client. It's the safe way to see ES. Give Terminal Full Disk Access (System Settings ▸ Privacy & Security), then:
Every process launch on your Mac streams as JSON. One event, trimmed, looks like this:
This is real Endpoint Security data — the exact event stream Mac Monitor consumes. Try sudo eslogger open (file opens) or sudo eslogger es_event_types to list everything subscribable. No code, no entitlement — just observe.
| Category | Example event types |
|---|---|
| Process | exec, fork, exit, signal, get_task (code injection!) |
| File | open, create, unlink, rename, write, clone |
| Mount / disk | mount, unmount, remount |
| System | setuid, kextload, iokit_open, cs_invalidated (code-sign tampering) |
There are 100+ event types. An EDR subscribes to a curated set, builds a process tree, and flags anomalies — all from this stream.
| Network Extension (you built) | Endpoint Security | |
|---|---|---|
| Watches | network flows | process/file/system events |
| Language | Swift / Obj-C | C API (call from C/Obj-C/Swift) |
| Entitlement | self-service capability | Apple request form |
| Replaced | socket-filter kexts | KAUTH kexts |
| Can block? | yes (.drop()) | yes (AUTH DENY) |
NOTIFY = observe after the fact. AUTH = the kernel blocks pending your ES_AUTH_RESULT_ALLOW/DENY — you can veto the action.
ES needs com.apple.developer.endpoint-security.client, granted only via Apple's request form (they vet you), plus Full Disk Access. The NE capability was self-service; ES is not.
sudo eslogger <event> — Apple's built-in, pre-entitled ES client (e.g. sudo eslogger exec). Needs Full Disk Access for Terminal.
KAUTH (kernel authorization) kexts — and the older in-kernel MAC hooks.
eslogger output, see what events Mac Monitor subscribes to, or understand the AUTH-deadline risk? Ask. One family left — the drivers: say "Lesson 8".