<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_message_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@SA@es_message_t"
  },
  "title" : "es_message_t"
}
-->

# es_message_t

A message from the Endpoint Security subsystem that describes a security event.

```
struct es_message_t
```

## Overview

A message contains an [`event`](/documentation/EndpointSecurity/es_message_t/event) monitored by Endpoint Security and an [`action`](/documentation/EndpointSecurity/es_message_t/action) to perform. The [`event`](/documentation/EndpointSecurity/es_message_t/event) is a union of types specific to each kind of event. For example, a file-renaming event provides the source and destination paths as the union member `rename`. Similarly, a process fork event provides the process identifier of the new child process as the union member `fork`. Inspect the [`event_type`](/documentation/EndpointSecurity/es_message_t/event_type) to determine which member of the union to access.

A message can be an authorization request, or a notification of an event that has already taken place, as indicated by the [`action_type`](/documentation/EndpointSecurity/es_message_t/action_type) field. For authorization messages, your client handler calls [`es_respond_auth_result(_:_:_:_:)`](/documentation/EndpointSecurity/es_respond_auth_result(_:_:_:_:)) or [`es_respond_flags_result(_:_:_:_:)`](/documentation/EndpointSecurity/es_respond_flags_result(_:_:_:_:)) to authorize, deny, or pass behavior flags back to Endpoint Security.

## Topics

### Inspecting Message Properties

[`action`](/documentation/EndpointSecurity/es_message_t/action)

The action monitored by Endpoint Security.

[`action_type`](/documentation/EndpointSecurity/es_message_t/action_type)

The type of action: authentication or notification.

[`es_action_type_t`](/documentation/EndpointSecurity/es_action_type_t)

The type of the message’s action.

[`es_event_id_t`](/documentation/EndpointSecurity/es_event_id_t)

An opaque identifier for events.

[`es_result_t`](/documentation/EndpointSecurity/es_result_t)

The result of the Endpoint Security subsystem authorization process.

[`version`](/documentation/EndpointSecurity/es_message_t/version)

The version of the Endpoint Security message.

### Identifying the Matched Event

[`event`](/documentation/EndpointSecurity/es_message_t/event)

The event that triggered this message.

[`es_events_t`](/documentation/EndpointSecurity/es_events_t)

A C union of event-specific types.

[`event_type`](/documentation/EndpointSecurity/es_message_t/event_type)

The type of the message’s event.

[`es_event_type_t`](/documentation/EndpointSecurity/es_event_type_t)

A type used to identify a message’s event type and subscribe to events of that type.

### Inspecting Timing Properties

[`time`](/documentation/EndpointSecurity/es_message_t/time)

The time the event occurred, expressed as a Darwin time value.

[`mach_time`](/documentation/EndpointSecurity/es_message_t/mach_time)

The time the event occurred, as a Mach time value.

[`deadline`](/documentation/EndpointSecurity/es_message_t/deadline)

The deadline by which your app must respond to the event.

[`seq_num`](/documentation/EndpointSecurity/es_message_t/seq_num)

The sequence number of the message.

[`global_seq_num`](/documentation/EndpointSecurity/es_message_t/global_seq_num)

The global sequence number of the message.

### Identifying the Source Process

[`process`](/documentation/EndpointSecurity/es_message_t/process)

The process that performed the action defined in a message.

[`es_process_t`](/documentation/EndpointSecurity/es_process_t)

A type that describes a process, as delivered by an Endpoint Security message.

### Inspecting Thread Properties

[`thread`](/documentation/EndpointSecurity/es_message_t/thread)

The thread that took the action defined in a message.

[`es_thread_t`](/documentation/EndpointSecurity/es_thread_t)

A structure that represents a thread in a process.

### Reserved Properties

[`opaque`](/documentation/EndpointSecurity/es_message_t/opaque)

An opaque storage field.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)