A message from the Endpoint Security subsystem that describes a security event.
- macOS 10.15+
- Mac Catalyst 13.0+
A message contains an
event monitored by Endpoint Security and an
action to perform. The
event is a union of types specific to each kind of event. For example, a file-renaming event provides the source and destination paths as the union member
rename. Similarly, a process fork event provides the process identifier of the new child process as the union member
fork. Inspect the
event to determine which member of the union to access.
A message can be an authorization request, or a notification of an event that has already taken place, as indicated by the
action field. For authorization messages, your client handler calls
es to authorize, deny, or pass behavior flags back to Endpoint Security.