<!--
{
  "availability" : [
    "macOS: 11.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_exec_fd(_:_:)",
  "metadataVersion" : "0.1.0",
  "role" : "Function",
  "symbol" : {
    "kind" : "Function",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@F@es_exec_fd"
  },
  "title" : "es_exec_fd(_:_:)"
}
-->

# es_exec_fd(_:_:)

Gets the file descriptor at the specified position from a process execution event.

```
func es_exec_fd(_ event: UnsafePointer<es_event_exec_t>, _ index: UInt32) -> UnsafePointer<es_fd_t>
```

## Parameters

`event`

The process execution event.

`index`

The zero-based index of the argument to return. Attempting to read an out-of-bounds index — where `index >= es_fd_arg_count()` — results in undefined behavior.

## Return Value

A pointer to an [`es_fd_t`](/documentation/EndpointSecurity/es_fd_t) instance that describes the file descriptor.

## Discussion

This function doesn’t allocate memory for the returned file descriptor description; it points to an [`es_fd_t`](/documentation/EndpointSecurity/es_fd_t) inside of `event`. Because you don’t own this memory, don’t try to free it.

> Warning:
> The returned pointer must not outlive the `event` parameter passed to the function, because the pointer will likely be invalid after the function returns.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)