How to Trace and Audit Endpoint Security Client Events in macOS Using eslogger

Monitoring system security, software integrity, and low-level process activity on macOS requires direct visibility into system events without relying on intrusive kernel extensions (KEXTs). Apple’s Endpoint Security (ES) framework provides a modern C API that monitors system operations for potential threats. Starting in macOS Monterey and refined in macOS Sonoma and Sequoia, Apple introduced eslogger, a native command-line utility that interfaces directly with the Endpoint Security subsystem to stream structured event telemetry in real time.

What is eslogger and How Does It Operate?

The eslogger tool subscribes as a client to the Endpoint Security subsystem, intercepting system activity at the XNU kernel boundary. It captures detailed metadata regarding process creation, file system modifications, socket creation, signal dispatching, and privilege escalation. Events can be streamed directly to standard output as human-readable text or parsed into structured JSON for ingestion into SIEM platforms.

Prerequisites and Required Privileges

Because Endpoint Security handles sensitive system telemetry across all users and processes, eslogger requires full administrative root privileges and Full Disk Access (FDA):

1. Open System Settings on macOS.
2. Navigate to Privacy & Security > Full Disk Access.
3. Ensure your terminal emulator (e.g., Terminal or iTerm2) is toggled On.
4. Execute commands using sudo.

Listing Available Endpoint Security Event Types

To inspect all event categories supported by your version of macOS:

eslogger --list-events

Common event types include:

• exec: Process execution and binary launches.
• fork: Process duplication.
• open: File open attempts.
• rename: File renaming and relocation.
• unlink: File deletion operations.
• setextattr: Extended attribute modifications.

Streaming Process Execution Events

To monitor every application and binary executed on macOS in real time:

sudo eslogger exec

To output events in JSON format for automated analysis or script ingestion:

sudo eslogger --format json exec

The JSON output contains extensive audit details, including the binary path, code signing status, Team ID, CDHash, parent process ID (PPID), responsible process, and command-line arguments.

Monitoring File Deletions and Sensitive Path Access

Security engineers can monitor file system modifications across critical directories:

# Stream unlink (deletion) and rename events simultaneously:
sudo eslogger unlink rename

When combined with standard command-line processing utilities like jq, you can filter for specific suspicious behaviours, such as unsigned binaries executing out of /tmp or ~/Library/Application Support:

sudo eslogger --format json exec | jq -r 'select(.process.signing_info.cs_flags == 0) | "(.event.exec.target.executable.path) executed without valid signature"'

Utilising eslogger equips macOS system administrators, security engineers, and developers with native, zero-overhead forensic auditing capabilities built directly into the operating system.