Writing a Process Monitor with Apple's Endpoint Security Framework
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Patrick Wardle's post walks through building a process monitor on Apple's new Endpoint Security Framework in macOS 10.15 (Catalina), as a replacement for the older OpenBSM audit subsystem.