# es_events_t A C union of event-specific types. ``` struct es_events_t ``` ## Overview Each event monitored by Endpoint Security delivers different properties to clients. For example, a file-renaming event provides source and target paths, while a process-forking event provides the process identifier of the new child process. This C `union` represents each kind of event as a unique member, each with a type specific to the kind of data it contains. ## Topics ### File-System Events [`access`](/documentation/EndpointSecurity/es_events_t/access) Properties of an event that indicates the checking of a file’s access permission. [`clone`](/documentation/EndpointSecurity/es_events_t/clone) Properties of an event that indicates the cloning of a file. [`copyfile`](/documentation/EndpointSecurity/es_events_t/copyfile) Properties of an event that indicates the cloning of a file. [`close`](/documentation/EndpointSecurity/es_events_t/close) Properties of an event that indicates the closing of a file. [`create`](/documentation/EndpointSecurity/es_events_t/create) Properties of an event that indicates the creation of a file. [`dup`](/documentation/EndpointSecurity/es_events_t/dup) Properties of an event that indicates the duplication of a file descriptor. [`exchangedata`](/documentation/EndpointSecurity/es_events_t/exchangedata) Properties of an event that indicates the exchange of data between two files. [`fcntl`](/documentation/EndpointSecurity/es_events_t/fcntl) Properties of an event that indicates the manipulation of a file descriptor. [`open`](/documentation/EndpointSecurity/es_events_t/open) Properties of an event that indicates the opening of a file. [`rename`](/documentation/EndpointSecurity/es_events_t/rename) Properties of an event that indicates the renaming of a file. [`write`](/documentation/EndpointSecurity/es_events_t/write) Properties of an event that indicates the writing of data to a file. [`truncate`](/documentation/EndpointSecurity/es_events_t/truncate) Properties of an event that indicates the truncation of a file. [`lookup`](/documentation/EndpointSecurity/es_events_t/lookup) Properties of an event that indicates the lookup of a file’s path. [`searchfs`](/documentation/EndpointSecurity/es_events_t/searchfs) Properties of an event that indicates a search operation on a volume or mounted file system. ### File Metadata Events [`deleteextattr`](/documentation/EndpointSecurity/es_events_t/deleteextattr) Properties of an event that indicates the deletion of an extended attribute from a file. [`fsgetpath`](/documentation/EndpointSecurity/es_events_t/fsgetpath) Properties of an event that indicates the retrieval of a file-system path. [`getattrlist`](/documentation/EndpointSecurity/es_events_t/getattrlist) Properties of an event that indicates the retrieval of attributes from a file. [`getextattr`](/documentation/EndpointSecurity/es_events_t/getextattr) Properties of an event that indicates the retrieval of an extended attribute from a file. [`listextattr`](/documentation/EndpointSecurity/es_events_t/listextattr) Properties of an event that indicates the retrieval of multiple extended attributes from a file. [`readdir`](/documentation/EndpointSecurity/es_events_t/readdir) Properties of an event that indicates the reading of a file-system directory. [`setacl`](/documentation/EndpointSecurity/es_events_t/setacl) Properties of an event that indicates the setting of a file’s access control list. [`setattrlist`](/documentation/EndpointSecurity/es_events_t/setattrlist) Properties of an event that indicates the setting of an attribute of a file. [`setextattr`](/documentation/EndpointSecurity/es_events_t/setextattr) Properties of an event that indicates the setting of an extended attribute of a file. [`setflags`](/documentation/EndpointSecurity/es_events_t/setflags) Properties of an event that indicates the setting of a file’s flags. [`setmode`](/documentation/EndpointSecurity/es_events_t/setmode) Properties of an event that indicates the setting of a file’s mode. [`setowner`](/documentation/EndpointSecurity/es_events_t/setowner) Properties of an event that indicates the setting of a file’s owner. [`stat`](/documentation/EndpointSecurity/es_events_t/stat) Properties of an event that indicates the retrieval of a file’s status. [`utimes`](/documentation/EndpointSecurity/es_events_t/utimes) Properties of an event that indicates a change to a file’s access time or modification time. ### File Provider Events [`file_provider_materialize`](/documentation/EndpointSecurity/es_events_t/file_provider_materialize) Properties of an event that indicates the materialization of a file provider. [`file_provider_update`](/documentation/EndpointSecurity/es_events_t/file_provider_update) Properties of an event that indicates an update to a file provider. ### Symbolic Link Events [`link`](/documentation/EndpointSecurity/es_events_t/link) Properties of an event that indicates the creation of a hard link. [`readlink`](/documentation/EndpointSecurity/es_events_t/readlink) Properties of an event that indicates the reading of a symbolic link. [`unlink`](/documentation/EndpointSecurity/es_events_t/unlink) Properties of an event that indicates the deletion of a file. ### File System Mounting Events [`mount`](/documentation/EndpointSecurity/es_events_t/mount) Properties of an event that indicates the mounting of a file system. [`unmount`](/documentation/EndpointSecurity/es_events_t/unmount) Properties of an event that indicates the unmounting of a file system. [`remount`](/documentation/EndpointSecurity/es_events_t/remount) Properties of an event that indicates the remounting of a file system. ### Memory Mapping Events [`mmap`](/documentation/EndpointSecurity/es_events_t/mmap) Properties of an event that indicates the mapping of memory to a file. [`mprotect`](/documentation/EndpointSecurity/es_events_t/mprotect) Properties of an event that indicates a change to protection of memory-mapped pages. ### Process Events [`chdir`](/documentation/EndpointSecurity/es_events_t/chdir) Properties of an event that indicates a change to a process’s working directory. [`chroot`](/documentation/EndpointSecurity/es_events_t/chroot) Properties of an event that indicates a change to a process’s root directory. [`exec`](/documentation/EndpointSecurity/es_events_t/exec) Properties of an event that indicates the execution of a process. [`fork`](/documentation/EndpointSecurity/es_events_t/fork) Properties of an event that indicates the forking of a process. [`proc_check`](/documentation/EndpointSecurity/es_events_t/proc_check) Properties of an event that indicate the retrieval of process information. [`signal`](/documentation/EndpointSecurity/es_events_t/signal) Properties of an event that indicates the sending of a signal to a process. [`exit`](/documentation/EndpointSecurity/es_events_t/exit) Properties of an event that indicates a process exiting. ### Interprocess Events [`proc_suspend_resume`](/documentation/EndpointSecurity/es_events_t/proc_suspend_resume) Properties of an event that indicates a call to suspend, resume, or shut down sockets for a process. [`trace`](/documentation/EndpointSecurity/es_events_t/trace) Properties of an event that indicates an attempt by one process to attach to another. [`remote_thread_create`](/documentation/EndpointSecurity/es_events_t/remote_thread_create) Properties of an event that indicates an attempt by one process to spawn a thread in another. ### Task Port Events [`get_task`](/documentation/EndpointSecurity/es_events_t/get_task) Properties of an event that indicates the retrieval of a task’s control port. [`get_task_read`](/documentation/EndpointSecurity/es_events_t/get_task_read) Properties of an event that indicates the retrieval of a task’s read port. [`get_task_inspect`](/documentation/EndpointSecurity/es_events_t/get_task_inspect) Properties of an event that indicates the retrieval of a task’s inspect port. [`get_task_name`](/documentation/EndpointSecurity/es_events_t/get_task_name) Properties of an event that indicates the retrieval of a task’s name port. ### User and Group ID Events [`setuid`](/documentation/EndpointSecurity/es_events_t/setuid) Properties of an event that indicates a change to a process’s user ID. [`setgid`](/documentation/EndpointSecurity/es_events_t/setgid) Properties of an event that indicates a change to a process’s group ID. [`seteuid`](/documentation/EndpointSecurity/es_events_t/seteuid) Properties of an event that indicates a change to a process’s effective user ID. [`setegid`](/documentation/EndpointSecurity/es_events_t/setegid) Properties of an event that indicates a change to a process’s effective group ID. [`setreuid`](/documentation/EndpointSecurity/es_events_t/setreuid) Properties of an event that indicates a change to a process’s real and effective user IDs. [`setregid`](/documentation/EndpointSecurity/es_events_t/setregid) Properties of an event that indicates a change to a process’s real and effective group IDs. ### Code Signing Events [`cs_invalidated`](/documentation/EndpointSecurity/es_events_t/cs_invalidated) Properties of an event that indicates the invalidation of a process’s code signing status. ### Socket Events [`uipc_bind`](/documentation/EndpointSecurity/es_events_t/uipc_bind) Properties of an event that indicates the binding of a socket to a path. [`uipc_connect`](/documentation/EndpointSecurity/es_events_t/uipc_connect) Properties of an event that indicates the connection of a socket. ### Clock Events [`settime`](/documentation/EndpointSecurity/es_events_t/settime) Properties of an event that indicates the modification of the system time. ### Kernel Events [`iokit_open`](/documentation/EndpointSecurity/es_events_t/iokit_open) Properties of an event that indicates the opening of an IOKit device. [`kextload`](/documentation/EndpointSecurity/es_events_t/kextload) Properties of an event that indicates the loading of a Kernel Extension (KEXT). [`kextunload`](/documentation/EndpointSecurity/es_events_t/kextunload) Properties of an event that indicates the unloading of a Kernel Extension (KEXT). ### Pseudoterminal Events [`pty_close`](/documentation/EndpointSecurity/es_events_t/pty_close) Properties of the event that indicates the closing of a pseudoterminal device. [`pty_grant`](/documentation/EndpointSecurity/es_events_t/pty_grant) Properties of the event that indicates the granting of a pseudoterminal device to a user. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)