<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_event_exec_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@SA@es_event_exec_t"
  },
  "title" : "es_event_exec_t"
}
-->

# es_event_exec_t

A type for an event that indicates the execution of a process.

```
struct es_event_exec_t
```

## Overview

To get the process’ arguments, file descriptors, and environment variables from this type, use the following functions:

- Arguments — [`es_exec_arg(_:_:)`](/documentation/EndpointSecurity/es_exec_arg(_:_:)) and [`es_exec_arg_count(_:)`](/documentation/EndpointSecurity/es_exec_arg_count(_:)).
- Environment variables — [`es_exec_env(_:_:)`](/documentation/EndpointSecurity/es_exec_env(_:_:)), and [`es_exec_env_count(_:)`](/documentation/EndpointSecurity/es_exec_env_count(_:)).
- File descriptors — [`es_exec_fd(_:_:)`](/documentation/EndpointSecurity/es_exec_fd(_:_:)), [`es_exec_fd_count(_:)`](/documentation/EndpointSecurity/es_exec_fd_count(_:)).

## Topics

### Inspecting Event Properties

[`target`](/documentation/EndpointSecurity/es_event_exec_t/target)

The process to execute.

[`es_process_t`](/documentation/EndpointSecurity/es_process_t)

A type that describes a process, as delivered by an Endpoint Security message.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)