Endpoint security API limitations

I'm wondering about using the API in the context of writing a EDR (endpoint detection tool).
  1. Would the API allow me to monitor http urls from all type of client applications?

  2. Would the SSL data be seen as encrypted or not?

  3. What about requests that would be made using a VPN? Would the requests be encrypted and sent to the VPN host and visible by the API as calls to vpn or the original server?

  4. What about requests coming from a virtual machine? Such as virtualbox or others?

You cannot use EndpointSecurity APIs for those things. See NetworkExtension framework for details.
Endpoint security API limitations
 
 
Q