<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_event_type_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@EA@es_event_type_t"
  },
  "title" : "es_event_type_t"
}
-->

# es_event_type_t

A type used to identify a message’s event type and subscribe to events of that type.

```
struct es_event_type_t
```

## Overview

Call the [`es_subscribe(_:_:_:)`](/documentation/EndpointSecurity/es_subscribe(_:_:_:)) function with the constants defined by this type to subscribe to specific Endpoint Security events.

You also use this type when inspecting a received message. The [`es_message_t`](/documentation/EndpointSecurity/es_message_t) member [`event_type`](/documentation/EndpointSecurity/es_message_t/event_type), which is of this type, indicates what kind of event the [`event`](/documentation/EndpointSecurity/es_message_t/event) field contains.

## Topics

### Authorization Event Types

[`ES_EVENT_TYPE_AUTH_CHDIR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_CHDIR)

An identifier for a process that requests permission from the operating system to change the working directory for the process.

[`ES_EVENT_TYPE_AUTH_CHROOT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_CHROOT)

An identifier for a process that requests permission from the operating system to change the root directory for the process.

[`ES_EVENT_TYPE_AUTH_CLONE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_CLONE)

An identifier for a process that requests permission from the operating system to clone a file.

[`ES_EVENT_TYPE_AUTH_COPYFILE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_COPYFILE)

An identifier for a process that requests permission from the operating system to copy a file.

[`ES_EVENT_TYPE_AUTH_CREATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_CREATE)

An identifier for a process that requests permission from the operating system to create a file.

[`ES_EVENT_TYPE_AUTH_DELETEEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_DELETEEXTATTR)

An identifier for a process that requests permission from the operating system to delete an extended attribute from a file.

[`ES_EVENT_TYPE_AUTH_EXCHANGEDATA`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_EXCHANGEDATA)

An identifier for a process that requests permission from the operating system to exchange data between two files.

[`ES_EVENT_TYPE_AUTH_EXEC`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_EXEC)

An identifier for a process that requests permission from the operating system to execute another image.

[`ES_EVENT_TYPE_AUTH_FCNTL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_FCNTL)

An identifier for a process that requests permission from the operating system to manipulate a file descriptor.

[`ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE)

An identifier for a process that requests permission for a file provider to return a reference to a file.

[`ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE)

An identifier for a process that requests permission from the operating system to update a file.

[`ES_EVENT_TYPE_AUTH_FSGETPATH`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_FSGETPATH)

An identifier for a process that requests permission from the operating system to retrieve a file system path.

[`ES_EVENT_TYPE_AUTH_GET_TASK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_GET_TASK)

An identifier for a process that requests permission from the operating system to retrieve a process’s task control port.

[`ES_EVENT_TYPE_AUTH_GET_TASK_READ`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_GET_TASK_READ)

An identifier for a process that requests permission from the operating system to retrieve a process’s task read port.

[`ES_EVENT_TYPE_AUTH_GETATTRLIST`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_GETATTRLIST)

An identifier for a process that requests permission from the operating system to retrieve attributes from a file.

[`ES_EVENT_TYPE_AUTH_GETEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_GETEXTATTR)

An identifier for a process that requests permission from the operating system to retrieve an extended attribute from a file.

[`ES_EVENT_TYPE_AUTH_IOKIT_OPEN`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_IOKIT_OPEN)

An identifier for a process that requests permission from the operating system to open an IOKit device.

[`ES_EVENT_TYPE_AUTH_KEXTLOAD`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_KEXTLOAD)

An identifier for a process that requests permission from the operating system to load a kernel extension (KEXT).

[`ES_EVENT_TYPE_AUTH_LINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_LINK)

An identifier for a process that requests permission from the operating system to create a hard link.

[`ES_EVENT_TYPE_AUTH_LISTEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_LISTEXTATTR)

An identifier for a process that requests permission from the operating system to retrieve multiple extended attributes from a file.

[`ES_EVENT_TYPE_AUTH_MMAP`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_MMAP)

An identifier for a process that requests permission from the operating system to map a file into memory.

[`ES_EVENT_TYPE_AUTH_MOUNT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_MOUNT)

An identifier for a process that requests permission from the operating system to mount a file system.

[`ES_EVENT_TYPE_AUTH_MPROTECT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_MPROTECT)

An identifier for a process that requests permission from the operating system to change the protection of memory-mapped pages.

[`ES_EVENT_TYPE_AUTH_OPEN`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_OPEN)

An identifier for a process that requests permission from the operating system to open a file.

[`ES_EVENT_TYPE_AUTH_PROC_CHECK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_PROC_CHECK)

An identifier for a process that requests permission from the operating system to get information about a process.

[`ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME)

An identifier for a process that requests permission from the operating system to suspend, resume, or shut down sockets for another process.

[`ES_EVENT_TYPE_AUTH_READDIR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_READDIR)

An identifier for a process that requests permission from the operating system to read a file system directory.

[`ES_EVENT_TYPE_AUTH_READLINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_READLINK)

An identifier for a process that requests permission from the operating system to read a symbolic link.

[`ES_EVENT_TYPE_AUTH_REMOUNT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_REMOUNT)

An identifier for a process that requests permission from the operating system to mount a file system.

[`ES_EVENT_TYPE_AUTH_RENAME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_RENAME)

An identifier for a process that requests permission from the operating system to rename a file.

[`ES_EVENT_TYPE_AUTH_SEARCHFS`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SEARCHFS)

An identifier for a process that requests permission from the operating system to search a volume or mounted file system.

[`ES_EVENT_TYPE_AUTH_SETACL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETACL)

An identifier for a process that requests permission from the operating system to set a file’s access control list.

[`ES_EVENT_TYPE_AUTH_SETATTRLIST`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETATTRLIST)

An identifier for a process that requests permission from the operating system to set attributes of a file.

[`ES_EVENT_TYPE_AUTH_SETEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETEXTATTR)

An identifier for a process that requests permission from the operating system to set an extended attribute of a file.

[`ES_EVENT_TYPE_AUTH_SETFLAGS`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETFLAGS)

An identifier for a process that requests permission from the operating system to set a file’s flags.

[`ES_EVENT_TYPE_AUTH_SETMODE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETMODE)

An identifier for a process that requests permission from the operating system to set a file’s mode.

[`ES_EVENT_TYPE_AUTH_SETOWNER`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETOWNER)

An identifier for a process that requests permission from the operating system to set a file’s owner.

[`ES_EVENT_TYPE_AUTH_SETTIME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SETTIME)

An identifier for a process that requests permission from the operating system to modify the system time.

[`ES_EVENT_TYPE_AUTH_SIGNAL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_SIGNAL)

An identifier for a process that requests permission from the operating system to send a signal to a process.

[`ES_EVENT_TYPE_AUTH_TRUNCATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_TRUNCATE)

An identifier for a process that requests permission from the operating system to truncate a file.

[`ES_EVENT_TYPE_AUTH_UIPC_BIND`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_UIPC_BIND)

An identifier for a process that requests permission from the operating system to bind a UNIX domain socket.

[`ES_EVENT_TYPE_AUTH_UIPC_CONNECT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_UIPC_CONNECT)

An identifier for a process that requests permission from the operating system to connect a UNIX domain socket.

[`ES_EVENT_TYPE_AUTH_UNLINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_UNLINK)

An identifier for a process that requests permission from the operating system to delete a file.

[`ES_EVENT_TYPE_AUTH_UTIMES`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_UTIMES)

An identifier for a process that requests permission from the operating system to change a file’s access or modification time.

### Notification Event Types

[`ES_EVENT_TYPE_NOTIFY_ACCESS`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_ACCESS)

An identifier for a process that notifies endpoint security that it is checking a file’s access permission.

[`ES_EVENT_TYPE_NOTIFY_CHDIR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CHDIR)

An identifier for a process that notifies endpoint security that it is changing the working directory for the process.

[`ES_EVENT_TYPE_NOTIFY_CHROOT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CHROOT)

An identifier for a process that notifies endpoint security that it is changing the root directory for the process.

[`ES_EVENT_TYPE_NOTIFY_CLONE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CLONE)

An identifier for a process that notifies endpoint security that it is cloning a file.

[`ES_EVENT_TYPE_NOTIFY_CLOSE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CLOSE)

An identifier for a process that notifies endpoint security that it is closing a file.

[`ES_EVENT_TYPE_NOTIFY_COPYFILE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_COPYFILE)

An identifier for a process that notifies endpoint security that it is copying a file.

[`ES_EVENT_TYPE_NOTIFY_CREATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CREATE)

An identifier for a process that notifies endpoint security that it is creating a file.

[`ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED)

An identifier for a process that notifies endpoint security that its code signing status is now invalid.

[`ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR)

An identifier for a process that notifies endpoint security that it is deleting an extended attribute from a file.

[`ES_EVENT_TYPE_NOTIFY_DUP`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_DUP)

An identifier for a process that notifies endpoint security that it is duplicating a file descriptor.

[`ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA)

An identifier for a process that notifies endpoint security that it is exchanging data between two files.

[`ES_EVENT_TYPE_NOTIFY_EXEC`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_EXEC)

An identifier for a process that notifies endpoint security that it is executing an image.

[`ES_EVENT_TYPE_NOTIFY_EXIT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_EXIT)

An identifier for a process that notifies endpoint security that it is exiting.

[`ES_EVENT_TYPE_NOTIFY_FCNTL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FCNTL)

An identifier for a process that notifies endpoint security that it is manipulating a file descriptor.

[`ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE)

An identifier for a process that notifies endpoint security that a file provider returned a reference to a file.

[`ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE)

An identifier for a process that notifies endpoint security that it is updating a file.

[`ES_EVENT_TYPE_NOTIFY_FORK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FORK)

An identifier for a process that notifies endpoint security that it is forking another process.

[`ES_EVENT_TYPE_NOTIFY_FSGETPATH`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FSGETPATH)

An identifier for a process that notifies endpoint security that it is retrieving a file system path.

[`ES_EVENT_TYPE_NOTIFY_GETATTRLIST`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GETATTRLIST)

An identifier for a process that notifies endpoint security that it is retrieving attributes from a file.

[`ES_EVENT_TYPE_NOTIFY_GETEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GETEXTATTR)

An identifier for a process that notifies endpoint security that it is retrieving an extended attribute from a file.

[`ES_EVENT_TYPE_NOTIFY_GET_TASK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GET_TASK)

An identifier for a process that notifies endpoint security that it is retrieving the task control port for another process.

[`ES_EVENT_TYPE_NOTIFY_GET_TASK_READ`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GET_TASK_READ)

An identifier for a process that notifies endpoint security that it is retrieving the task read port for another process.

[`ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT)

An identifier for a process that notifies endpoint security that it is retrieving the task inspect port for another process.

[`ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME)

An identifier for a process that notifies endpoint security that it is retrieving the task name port for another process.

[`ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN)

An identifier for a process that notifies endpoint security that it is opening an IOKit device.

[`ES_EVENT_TYPE_NOTIFY_KEXTLOAD`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_KEXTLOAD)

An identifier for a process that notifies endpoint security that it is loading a kernel extension (KEXT).

[`ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD)

An identifier for a process that notifies endpoint security that it is unloading a kernel extension (KEXT).

[`ES_EVENT_TYPE_NOTIFY_LINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_LINK)

An identifier for a process that notifies endpoint security that it is creating a hard link.

[`ES_EVENT_TYPE_NOTIFY_LISTEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_LISTEXTATTR)

An identifier for a process that notifies endpoint security that it is retrieving multiple extended attributes from a file.

[`ES_EVENT_TYPE_NOTIFY_LOOKUP`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_LOOKUP)

An identifier for a process that notifies endpoint security that it is looking up a file’s path.

[`ES_EVENT_TYPE_NOTIFY_MMAP`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_MMAP)

An identifier for a process that notifies endpoint security that it is mapping a file into memory.

[`ES_EVENT_TYPE_NOTIFY_MOUNT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_MOUNT)

An identifier for a process that notifies endpoint security that it is mounting a file system.

[`ES_EVENT_TYPE_NOTIFY_MPROTECT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_MPROTECT)

An identifier for a process that notifies endpoint security that it is changing the protection of memory-mapped pages.

[`ES_EVENT_TYPE_NOTIFY_OPEN`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_OPEN)

An identifier for a process that notifies endpoint security that it is opening a file.

[`ES_EVENT_TYPE_NOTIFY_PROC_CHECK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_PROC_CHECK)

An identifier for a process that notifies endpoint security that it is checking information about another process.

[`ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME)

An identifier for a process that notifies endpoint security that it is suspending, resuming, or shutting down sockets for another process.

[`ES_EVENT_TYPE_NOTIFY_PTY_CLOSE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_PTY_CLOSE)

An identifier for a process that notifies endpoint security that it is closing a pseudoterminal device.

[`ES_EVENT_TYPE_NOTIFY_PTY_GRANT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_PTY_GRANT)

An identifier for a process that notifies endpoint security that it is granting a pseudoterminal device to a user.

[`ES_EVENT_TYPE_NOTIFY_READDIR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_READDIR)

An identifier for a process that notifies endpoint security that it is reading a file system directory.

[`ES_EVENT_TYPE_NOTIFY_READLINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_READLINK)

An identifier for a process that notifies endpoint security that it is reading a symbolic link.

[`ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE)

An identifier for a process that notifies endpoint security that it is spawning a thread in another process.

[`ES_EVENT_TYPE_NOTIFY_REMOUNT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_REMOUNT)

An identifier for a process that notifies endpoint security that it is remounting a file system.

[`ES_EVENT_TYPE_NOTIFY_RENAME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_RENAME)

An identifier for a process that notifies endpoint security that it is renaming a file.

[`ES_EVENT_TYPE_NOTIFY_SEARCHFS`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SEARCHFS)

An identifier for a process that notifies endpoint security that it is searching a volume or mounted file system.

[`ES_EVENT_TYPE_NOTIFY_SETACL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETACL)

An identifier for a process that notifies endpoint security that it is setting a file’s access control list.

[`ES_EVENT_TYPE_NOTIFY_SETATTRLIST`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETATTRLIST)

An identifier for a process that notifies endpoint security that it is setting attributes of a file.

[`ES_EVENT_TYPE_NOTIFY_SETEGID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETEGID)

An identifier for a process that notifies endpoint security that it is setting its effective group ID.

[`ES_EVENT_TYPE_NOTIFY_SETEUID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETEUID)

An identifier for a process that notifies endpoint security that it is setting its effective user ID.

[`ES_EVENT_TYPE_NOTIFY_SETEXTATTR`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETEXTATTR)

An identifier for a process that notifies endpoint security that it is setting an extended attribute of a file.

[`ES_EVENT_TYPE_NOTIFY_SETGID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETGID)

An identifier for a process that notifies endpoint security that it is setting its group ID.

[`ES_EVENT_TYPE_NOTIFY_SETFLAGS`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETFLAGS)

An identifier for a process that notifies endpoint security that it is setting a file’s flags.

[`ES_EVENT_TYPE_NOTIFY_SETMODE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETMODE)

An identifier for a process that notifies endpoint security that it is setting a file’s mode.

[`ES_EVENT_TYPE_NOTIFY_SETOWNER`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETOWNER)

An identifier for a process that notifies endpoint security that it is setting a file’s owner.

[`ES_EVENT_TYPE_NOTIFY_SETREGID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETREGID)

An identifier for a process that notifies endpoint security that it is setting its real and effective group IDs.

[`ES_EVENT_TYPE_NOTIFY_SETREUID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETREUID)

An identifier for a process that notifies endpoint security that it is setting its real and effective user IDs.

[`ES_EVENT_TYPE_NOTIFY_SETTIME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETTIME)

An identifier for a process that notifies endpoint security that it is modifying the system time.

[`ES_EVENT_TYPE_NOTIFY_SETUID`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SETUID)

An identifier for a process that notifies endpoint security that it is setting its user ID.

[`ES_EVENT_TYPE_NOTIFY_SIGNAL`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_SIGNAL)

An identifier for a process that notifies endpoint security that it is sending a signal to another process.

[`ES_EVENT_TYPE_NOTIFY_STAT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_STAT)

An identifier for a process that notifies endpoint security that it is retrieving a file’s status.

[`ES_EVENT_TYPE_NOTIFY_TRACE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_TRACE)

An identifier for a process that notifies endpoint security that it is attaching to another process.

[`ES_EVENT_TYPE_NOTIFY_TRUNCATE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_TRUNCATE)

An identifier for a process that notifies endpoint security that it is truncating a file.

[`ES_EVENT_TYPE_NOTIFY_UIPC_BIND`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_UIPC_BIND)

An identifier for a process that notifies endpoint security that it is binding a UNIX domain socket.

[`ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT)

An identifier for a process that notifies endpoint security that it is connecting to a UNIX domain socket.

[`ES_EVENT_TYPE_NOTIFY_UNLINK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_UNLINK)

An identifier for a process that notifies endpoint security that it is deleting a file.

[`ES_EVENT_TYPE_NOTIFY_UNMOUNT`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_UNMOUNT)

An identifier for a process that notifies endpoint security that it is unmounting a file system.

[`ES_EVENT_TYPE_NOTIFY_UTIMES`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_UTIMES)

An identifier for a process that notifies endpoint security that it is changing a file’s access or modification time.

[`ES_EVENT_TYPE_NOTIFY_WRITE`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_WRITE)

An identifier for a process that notifies endpoint security that it is writing data to a file.

### Enumeration Marker

[`ES_EVENT_TYPE_LAST`](/documentation/EndpointSecurity/ES_EVENT_TYPE_LAST)

A value that indicates the last member of the enumeration.

## Relationships

### Conforms To

[`RawRepresentable`](/documentation/Swift/RawRepresentable)

[`Equatable`](/documentation/Swift/Equatable)

[`Hashable`](/documentation/Swift/Hashable)

[`BitwiseCopyable`](/documentation/Swift/BitwiseCopyable)

[`Sendable`](/documentation/Swift/Sendable)

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)