De-mystifying Endpoint Security Messages

Endpoint Security is Apple's C API for monitoring system events. Its primary use is to allow security vendors to monitor for potentially malicious activity, but it also provides a great source of system telemetry for security researchers. ES Subsystem primer Typically, you would write a client that subscribes to specific events provided by the Endpoint Security Subsystem. These clients need to be…