<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_process_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@SA@es_process_t"
  },
  "title" : "es_process_t"
}
-->

# es_process_t

A type that describes a process, as delivered by an Endpoint Security message.

```
struct es_process_t
```

## Overview

For process events, this type also indicates the newly-executing process.

You can extract values such as the process identifier (`PID`), user identifier (`UID`), and group identifier (`GID`) from the [`audit_token`](/documentation/EndpointSecurity/es_process_t/audit_token) field by using functions defined in `libbsm.h`.

### Working with Code Signing

Fields related to code signing, such as [`cdhash`](/documentation/EndpointSecurity/es_process_t/cdhash) and [`signing_id`](/documentation/EndpointSecurity/es_process_t/signing_id), reflect the state of the process at the time Endpoint Security generated the message. In the specific case of process execution, this is after the `exec` completes in the kernel, but before any code in the process starts executing. At that point, XNU has validated the signature itself and has verified that the `cdhash` is correct. This second validation means that the hash of all individual page hashes in the Code Directory match the signed `cdhash`, essentially verifying the signature wasn’t tampered with. However, XNU doesn’t verify individual page hashes until the binary executes and pages in the corresponding pages. XNU doesn’t determine a binary shows signs of tampering until the individual pages page in, at which point XNU updates the code signing flags.

Endpoint Security provides clients the current state of the CS flags in the [`codesigning_flags`](/documentation/EndpointSecurity/es_process_t/codesigning_flags) member of the [`es_process_t`](/documentation/EndpointSecurity/es_process_t) structure. Keep the following points in mind when evaluating this field:

- The `CS_VALID` bit in [`codesigning_flags`](/documentation/EndpointSecurity/es_process_t/codesigning_flags) means that everything the kernel has validated up to that point in time was valid. However, this doesn’t mean there’s been a full validation of all the pages in the executable file. If a page’s content has been tampered with, XNU won’t know until that page pages in.
- When XNU detects a tampered page, it clears the `CS_VALID` bit. With the `CS_KILL` bit set, Endpoint Security terminates the process, preventing the tampered code from executing. Platform binaries and binaries that opted into the hardened runtime typically have the `CS_KILL` bit set.
- If you want your Endpoint Security client to detect tampered code before it pages in, such as at execution time, you can do so with the <doc://com.apple.documentation/documentation/Security> framework. However, this may impose a significant performance cost.
- Endpoint Security plays no role in verifying the validity of code signatures.

## Topics

### Inspecting the Source Process

[`audit_token`](/documentation/EndpointSecurity/es_process_t/audit_token)

A token for use with Basic Security Module auditing functions.

[`executable`](/documentation/EndpointSecurity/es_process_t/executable)

The file containing the executed process.

[`is_es_client`](/documentation/EndpointSecurity/es_process_t/is_es_client)

A Boolean value that indicates whether the process connects to the Endpoint Security subsystem.

[`is_platform_binary`](/documentation/EndpointSecurity/es_process_t/is_platform_binary)

A Boolean value that indicates whether the process is a platform binary.

[`start_time`](/documentation/EndpointSecurity/es_process_t/start_time)

The time the process started.

### Inspecting Process IDs

[`ppid`](/documentation/EndpointSecurity/es_process_t/ppid)

The parent process identifier.

[`original_ppid`](/documentation/EndpointSecurity/es_process_t/original_ppid)

The original parent process ID.

[`group_id`](/documentation/EndpointSecurity/es_process_t/group_id)

The process group identifier.

[`session_id`](/documentation/EndpointSecurity/es_process_t/session_id)

The identifier of the session that contains the process group.

[`tty`](/documentation/EndpointSecurity/es_process_t/tty)

The TTY associated with the process sending the message.

### Inspecting Code Signing Properties

[`codesigning_flags`](/documentation/EndpointSecurity/es_process_t/codesigning_flags)

The flags used to sign the process.

[`cdhash`](/documentation/EndpointSecurity/es_process_t/cdhash)

The code directory hash value.

[`signing_id`](/documentation/EndpointSecurity/es_process_t/signing_id)

The identifier used to sign the process.

[`team_id`](/documentation/EndpointSecurity/es_process_t/team_id)

The team identifier used to sign the process.

### Inspecting Audit Tokens

[`responsible_audit_token`](/documentation/EndpointSecurity/es_process_t/responsible_audit_token)

The audit token of the process responsible for this process.

[`parent_audit_token`](/documentation/EndpointSecurity/es_process_t/parent_audit_token)

The audit token of the parent process.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)