<!--
{
  "documentType" : "article",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/event-types",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Event Types"
}
-->

# Event Types

Types used by messages to deliver details specific to different kinds of Endpoint Security events.

## Discussion

The types in this section contain details of each event that an Endpoint Security message can contain. While the [`es_message_t`](/documentation/EndpointSecurity/es_message_t) type itself is generic, the members of its [`event`](/documentation/EndpointSecurity/es_message_t/event) union contain specific event types.

For example, when the message’s [`event_type`](/documentation/EndpointSecurity/es_message_t/event_type) is [`ES_EVENT_TYPE_NOTIFY_FORK`](/documentation/EndpointSecurity/ES_EVENT_TYPE_NOTIFY_FORK), you access the event’s [`fork`](/documentation/EndpointSecurity/es_events_t/fork) member, whose type is [`es_event_fork_t`](/documentation/EndpointSecurity/es_event_fork_t). This type has properties specific to process-forking events, such as the [`child`](/documentation/EndpointSecurity/es_event_fork_t/child) process that resulted from the fork operation.

## Topics

### File-System Event Types

[`es_file_t`](/documentation/EndpointSecurity/es_file_t)

A type that represents a file related to an Endpoint Security event.

[`es_event_access_t`](/documentation/EndpointSecurity/es_event_access_t)

A type for an event that indicates the checking of a file’s access permission.

[`es_event_clone_t`](/documentation/EndpointSecurity/es_event_clone_t)

A type for an event that indicates the cloning of a file.

[`es_event_copyfile_t`](/documentation/EndpointSecurity/es_event_copyfile_t)

A type for an event that indicates the copying of a file by use of a system call.

[`es_event_create_t`](/documentation/EndpointSecurity/es_event_create_t)

A type for an event that indicates the creation of a file.

[`es_event_dup_t`](/documentation/EndpointSecurity/es_event_dup_t)

A type for an event that indicates the duplication of a file descriptor.

[`es_event_fcntl_t`](/documentation/EndpointSecurity/es_event_fcntl_t)

A type for an event that indicates the manipulation of a file descriptor.

[`es_event_open_t`](/documentation/EndpointSecurity/es_event_open_t)

A type for an event that indicates the opening of a file.

[`es_event_close_t`](/documentation/EndpointSecurity/es_event_close_t)

A type for an event that indicates the closing of a file.

[`es_event_rename_t`](/documentation/EndpointSecurity/es_event_rename_t)

A type for an event that indicates the renaming of a file.

[`es_event_truncate_t`](/documentation/EndpointSecurity/es_event_truncate_t)

A type for an event that indicates the truncation of a file.

[`es_event_exchangedata_t`](/documentation/EndpointSecurity/es_event_exchangedata_t)

A type for an event that indicates the exchange of data between two files.

[`es_event_write_t`](/documentation/EndpointSecurity/es_event_write_t)

A type for an event that indicates the writing of data to a file.

[`es_event_lookup_t`](/documentation/EndpointSecurity/es_event_lookup_t)

A type for an event that indicates the lookup of a file’s path.

[`es_event_searchfs_t`](/documentation/EndpointSecurity/es_event_searchfs_t)

A type for an event that indicates searching a volume or mounted file system.

### File Metadata Event Types

[`es_event_deleteextattr_t`](/documentation/EndpointSecurity/es_event_deleteextattr_t)

A type for an event that indicates the deletion of an extended attribute from a file.

[`es_event_fsgetpath_t`](/documentation/EndpointSecurity/es_event_fsgetpath_t)

A type for an event that indicates the retrieval of a file-system path.

[`es_event_getattrlist_t`](/documentation/EndpointSecurity/es_event_getattrlist_t)

A type for an event that indicates the retrieval of attributes from a file.

[`es_event_getextattr_t`](/documentation/EndpointSecurity/es_event_getextattr_t)

A type for an event that indicates the retrieval of an extended attribute from a file.

[`es_event_listextattr_t`](/documentation/EndpointSecurity/es_event_listextattr_t)

A type for an event that indicates the retrieval of multiple extended attributes from a file.

[`es_event_readdir_t`](/documentation/EndpointSecurity/es_event_readdir_t)

A type for an event that indicates the reading of a file-system directory.

[`es_event_setacl_t`](/documentation/EndpointSecurity/es_event_setacl_t)

A type for an event that indicates the setting of a file’s access control list.

[`es_event_setattrlist_t`](/documentation/EndpointSecurity/es_event_setattrlist_t)

A type for an event that indicates the setting of a file attribute.

[`es_event_setextattr_t`](/documentation/EndpointSecurity/es_event_setextattr_t)

A type for an event that indicates the setting of a file’s extended attribute.

[`es_event_setflags_t`](/documentation/EndpointSecurity/es_event_setflags_t)

A type for an event that indicates the setting of a file’s flags.

[`es_event_setmode_t`](/documentation/EndpointSecurity/es_event_setmode_t)

A type for an event that indicates the setting of a file’s mode.

[`es_event_setowner_t`](/documentation/EndpointSecurity/es_event_setowner_t)

A type for an event that indicates the setting of a file’s owner.

[`es_event_stat_t`](/documentation/EndpointSecurity/es_event_stat_t)

A type for an event that indicates the retrieval of a file’s status.

[`es_event_utimes_t`](/documentation/EndpointSecurity/es_event_utimes_t)

A type for an event that indicates a change to a file’s access time or modification time.

### File Provider Event Types

[`es_event_file_provider_materialize_t`](/documentation/EndpointSecurity/es_event_file_provider_materialize_t)

A type for an event that indicates the materialization of a file provider.

[`es_event_file_provider_update_t`](/documentation/EndpointSecurity/es_event_file_provider_update_t)

A type for an event that indicates an update to a file provider.

### Link Event Types

[`es_event_link_t`](/documentation/EndpointSecurity/es_event_link_t)

A type for an event that indicates the creation of a hard link.

[`es_event_readlink_t`](/documentation/EndpointSecurity/es_event_readlink_t)

A type for an event that indicates the reading of a symbolic link.

[`es_event_unlink_t`](/documentation/EndpointSecurity/es_event_unlink_t)

A type for an event that indicates the deletion of a file.

### File System Mounting Event Types

[`es_event_mount_t`](/documentation/EndpointSecurity/es_event_mount_t)

A type for an event that indicates the mounting of a file system.

[`es_event_unmount_t`](/documentation/EndpointSecurity/es_event_unmount_t)

A type for an event that indicates the unmounting of a file system.

[`es_event_remount_t`](/documentation/EndpointSecurity/es_event_remount_t)

A type for an event that indicates the unmounting of a file system.

### Memory Mapping Event Types

[`es_event_mmap_t`](/documentation/EndpointSecurity/es_event_mmap_t)

A type for an event that indicates the mapping of memory to a file.

[`es_event_mprotect_t`](/documentation/EndpointSecurity/es_event_mprotect_t)

A type for an event that indicates a change to protection of memory-mapped pages.

### Process Event Types

[`es_event_chdir_t`](/documentation/EndpointSecurity/es_event_chdir_t)

A type for an event that indicates a change to a process’s working directory.

[`es_event_chroot_t`](/documentation/EndpointSecurity/es_event_chroot_t)

A type for an event that indicates a change to a process’s root directory.

[`es_event_exec_t`](/documentation/EndpointSecurity/es_event_exec_t)

A type for an event that indicates the execution of a process.

[`es_event_fork_t`](/documentation/EndpointSecurity/es_event_fork_t)

A type for an event that indicates the forking of a process.

[`es_event_proc_check_t`](/documentation/EndpointSecurity/es_event_proc_check_t)

A type that indicates the call used and the data returned when a process checks on the access of the target process.

[`es_event_signal_t`](/documentation/EndpointSecurity/es_event_signal_t)

A type for an event that indicates the sending of a signal to a process.

[`es_event_exit_t`](/documentation/EndpointSecurity/es_event_exit_t)

A type for an event that indicates a process exiting.

### Process Event Helper Functions

[`es_exec_arg(_:_:)`](/documentation/EndpointSecurity/es_exec_arg(_:_:))

Gets the argument at the specified position from a process execution event.

[`es_exec_arg_count(_:)`](/documentation/EndpointSecurity/es_exec_arg_count(_:))

Gets the number of arguments from a process execution event.

[`es_exec_env(_:_:)`](/documentation/EndpointSecurity/es_exec_env(_:_:))

Gets the environment variable at the specified position from a process execution event.

[`es_exec_env_count(_:)`](/documentation/EndpointSecurity/es_exec_env_count(_:))

Gets the number of environment variables from a process execution event.

[`es_exec_fd(_:_:)`](/documentation/EndpointSecurity/es_exec_fd(_:_:))

Gets the file descriptor at the specified position from a process execution event.

[`es_exec_fd_count(_:)`](/documentation/EndpointSecurity/es_exec_fd_count(_:))

Gets the number of file descriptors from a process execution event.

[`es_fd_t`](/documentation/EndpointSecurity/es_fd_t)

A structure that describes an open file descriptor.

### Interprocess Events

[`es_event_proc_suspend_resume_t`](/documentation/EndpointSecurity/es_event_proc_suspend_resume_t)

A type for an event that indicates a call to suspend, resume, or shut down sockets for a process.

[`es_event_trace_t`](/documentation/EndpointSecurity/es_event_trace_t)

A type for an event that indicates an attempt by one process to attach to another process.

[`es_event_remote_thread_create_t`](/documentation/EndpointSecurity/es_event_remote_thread_create_t)

A type for an event that indicates an attempt by one process to create a thread in another process.

### Task Port Event Types

[`es_event_get_task_t`](/documentation/EndpointSecurity/es_event_get_task_t)

A type for an event that indicates the retrieval of a task’s control port.

[`es_event_get_task_read_t`](/documentation/EndpointSecurity/es_event_get_task_read_t)

A type for an event that indicates the retrieval of a task’s read port.

[`es_event_get_task_inspect_t`](/documentation/EndpointSecurity/es_event_get_task_inspect_t)

A type for an event that indicates the retrieval of a task’s inspect port.

[`es_event_get_task_name_t`](/documentation/EndpointSecurity/es_event_get_task_name_t)

A type for an event that indicates the retrieval of a task’s name port.

### User and Group ID Types

[`es_event_setuid_t`](/documentation/EndpointSecurity/es_event_setuid_t)

A type for an event that indicates the setting of a process’s user ID.

[`es_event_setgid_t`](/documentation/EndpointSecurity/es_event_setgid_t)

A type for an event that indicates the setting of a process’s group ID.

[`es_event_seteuid_t`](/documentation/EndpointSecurity/es_event_seteuid_t)

A type for an event that indicates the setting of a process’s effective user ID.

[`es_event_setegid_t`](/documentation/EndpointSecurity/es_event_setegid_t)

A type for an event that indicates the setting of a process’s effective group ID.

[`es_event_setreuid_t`](/documentation/EndpointSecurity/es_event_setreuid_t)

A type for an event that indicates the setting of a process’s real and effective user IDs.

[`es_event_setregid_t`](/documentation/EndpointSecurity/es_event_setregid_t)

A type for an event that indicates the setting of a process’s real and effective group IDs.

### Code Signing Event Types

[`es_event_cs_invalidated_t`](/documentation/EndpointSecurity/es_event_cs_invalidated_t)

A type for an event that indicates the invalidation of a process’ code signing status.

### Socket Event Types

[`es_event_uipc_bind_t`](/documentation/EndpointSecurity/es_event_uipc_bind_t)

A type for an event that indicates the binding of a socket to a path.

[`es_event_uipc_connect_t`](/documentation/EndpointSecurity/es_event_uipc_connect_t)

A type for an event that indicates the connection of a socket.

### Clock Event Types

[`es_event_settime_t`](/documentation/EndpointSecurity/es_event_settime_t)

A type for an event that indicates the modification of the system time.

### Kernel Event Types

[`es_event_iokit_open_t`](/documentation/EndpointSecurity/es_event_iokit_open_t)

A type for an event that indicates the opening of an IOKit device.

[`es_event_kextload_t`](/documentation/EndpointSecurity/es_event_kextload_t)

A type for an event that indicates the loading of a kernel extension.

[`es_event_kextunload_t`](/documentation/EndpointSecurity/es_event_kextunload_t)

A type for an event that indicates the unloading of a Kernel Extension (KEXT).

### Pseudoterminal Event Types

[`es_event_pty_close_t`](/documentation/EndpointSecurity/es_event_pty_close_t)

A type for an event that indicates the closing of a pseudoterminal device.

[`es_event_pty_grant_t`](/documentation/EndpointSecurity/es_event_pty_grant_t)

A type for an event that indicates the granting of a pseudoterminal device to a user.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)