#include <EndpointSecurity/ESTypes.h> also included by <EndpointSecurity/EndpointSecurity.h>

EndpointSecurity/ESTypes.h

includes: mach/message.h, os/availability.h, os/base.h, stdint.h, sys/types.h, uuid/uuid.h

46 typedefs · 36 enums · 8 structs

typedefes_event_id_t

typedef struct es_event_id_t es_event_id_t;

enumes_action_type_t

underlying type unsigned int

ES_ACTION_TYPE_AUTH	0
ES_ACTION_TYPE_NOTIFY	1

typedefes_action_type_t

typedef enum es_action_type_t es_action_type_t;

enumes_set_or_clear_t

underlying type unsigned int

ES_SET	0
ES_CLEAR	1

typedefes_set_or_clear_t

typedef enum es_set_or_clear_t es_set_or_clear_t;

@brief This enum describes the type of the es_event_proc_check_t event that are currently used @note ES_PROC_CHECK_TYPE_KERNMSGBUF, ES_PROC_CHECK_TYPE_TERMINATE and ES_PROC_CHECK_TYPE_UDATA_INFO are deprecated and no proc_check messages will be generated for the corresponding proc_info call numbers. The terminate callnum is covered by the signal event.

underlying type unsigned int

ES_PROC_CHECK_TYPE_LISTPIDS	1
ES_PROC_CHECK_TYPE_PIDINFO	2
ES_PROC_CHECK_TYPE_PIDFDINFO	3
ES_PROC_CHECK_TYPE_KERNMSGBUF	4	deprecated, not generated
ES_PROC_CHECK_TYPE_SETCONTROL	5
ES_PROC_CHECK_TYPE_PIDFILEPORTINFO	6
ES_PROC_CHECK_TYPE_TERMINATE	7	deprecated, not generated
ES_PROC_CHECK_TYPE_DIRTYCONTROL	8
ES_PROC_CHECK_TYPE_PIDRUSAGE	9
ES_PROC_CHECK_TYPE_UDATA_INFO	14	deprecated, not generated

typedefes_proc_check_type_t

typedef enum es_proc_check_type_t es_proc_check_type_t;

enumes_xpc_domain_type_t

@brief This enum describes the types of XPC service domains.

underlying type unsigned int

ES_XPC_DOMAIN_TYPE_SYSTEM	1
ES_XPC_DOMAIN_TYPE_USER	2
ES_XPC_DOMAIN_TYPE_USER_LOGIN	3
ES_XPC_DOMAIN_TYPE_SESSION	4
ES_XPC_DOMAIN_TYPE_PID	5
ES_XPC_DOMAIN_TYPE_MANAGER	6
ES_XPC_DOMAIN_TYPE_PORT	7
ES_XPC_DOMAIN_TYPE_GUI	8

typedefes_xpc_domain_type_t

typedef enum es_xpc_domain_type_t es_xpc_domain_type_t;

enumes_authentication_type_t

@brief This enum describes the types of authentications that ES_EVENT_TYPE_NOTIFY_AUTHENTICATION can describe.

underlying type unsigned int

ES_AUTHENTICATION_TYPE_OD	0
ES_AUTHENTICATION_TYPE_TOUCHID	1
ES_AUTHENTICATION_TYPE_TOKEN	2
ES_AUTHENTICATION_TYPE_AUTO_UNLOCK	3
ES_AUTHENTICATION_TYPE_LAST	4	ES_AUTHENTICATION_TYPE_LAST is not a valid type of authentication but is a convenience value to operate on the range of defined authentication types.

typedefes_authentication_type_t

typedef enum es_authentication_type_t es_authentication_type_t;

enumes_sudo_plugin_type_t

@brief This enum describes the type of plugin types in sudo

underlying type unsigned int

ES_SUDO_PLUGIN_TYPE_UNKNOWN	0
ES_SUDO_PLUGIN_TYPE_FRONT_END	1
ES_SUDO_PLUGIN_TYPE_POLICY	2
ES_SUDO_PLUGIN_TYPE_IO	3
ES_SUDO_PLUGIN_TYPE_AUDIT	4
ES_SUDO_PLUGIN_TYPE_APPROVAL	5

typedefes_sudo_plugin_type_t

typedef enum es_sudo_plugin_type_t es_sudo_plugin_type_t;

enumes_event_type_t

The valid event types recognized by EndpointSecurity @discussion When a program subscribes to and receives an AUTH-related event, it must respond with an appropriate result indicating whether or not the operation should be allowed to continue. The valid API options are: - es_respond_auth_result - es_respond_flags_result Currently, only ES_EVENT_TYPE_AUTH_OPEN must use es_respond_flags_result. All other AUTH events must use es_respond_auth_result.

underlying type unsigned int

ES_EVENT_TYPE_AUTH_EXEC	0	The following events are available beginning in macOS 10.15
ES_EVENT_TYPE_AUTH_OPEN	1
ES_EVENT_TYPE_AUTH_KEXTLOAD	2
ES_EVENT_TYPE_AUTH_MMAP	3
ES_EVENT_TYPE_AUTH_MPROTECT	4
ES_EVENT_TYPE_AUTH_MOUNT	5
ES_EVENT_TYPE_AUTH_RENAME	6
ES_EVENT_TYPE_AUTH_SIGNAL	7
ES_EVENT_TYPE_AUTH_UNLINK	8
ES_EVENT_TYPE_NOTIFY_EXEC	9
ES_EVENT_TYPE_NOTIFY_OPEN	10
ES_EVENT_TYPE_NOTIFY_FORK	11
ES_EVENT_TYPE_NOTIFY_CLOSE	12
ES_EVENT_TYPE_NOTIFY_CREATE	13
ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA	14
ES_EVENT_TYPE_NOTIFY_EXIT	15
ES_EVENT_TYPE_NOTIFY_GET_TASK	16
ES_EVENT_TYPE_NOTIFY_KEXTLOAD	17
ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD	18
ES_EVENT_TYPE_NOTIFY_LINK	19
ES_EVENT_TYPE_NOTIFY_MMAP	20
ES_EVENT_TYPE_NOTIFY_MPROTECT	21
ES_EVENT_TYPE_NOTIFY_MOUNT	22
ES_EVENT_TYPE_NOTIFY_UNMOUNT	23
ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN	24
ES_EVENT_TYPE_NOTIFY_RENAME	25
ES_EVENT_TYPE_NOTIFY_SETATTRLIST	26
ES_EVENT_TYPE_NOTIFY_SETEXTATTR	27
ES_EVENT_TYPE_NOTIFY_SETFLAGS	28
ES_EVENT_TYPE_NOTIFY_SETMODE	29
ES_EVENT_TYPE_NOTIFY_SETOWNER	30
ES_EVENT_TYPE_NOTIFY_SIGNAL	31
ES_EVENT_TYPE_NOTIFY_UNLINK	32
ES_EVENT_TYPE_NOTIFY_WRITE	33
ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE	34
ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE	35
ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE	36
ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE	37
ES_EVENT_TYPE_AUTH_READLINK	38
ES_EVENT_TYPE_NOTIFY_READLINK	39
ES_EVENT_TYPE_AUTH_TRUNCATE	40
ES_EVENT_TYPE_NOTIFY_TRUNCATE	41
ES_EVENT_TYPE_AUTH_LINK	42
ES_EVENT_TYPE_NOTIFY_LOOKUP	43
ES_EVENT_TYPE_AUTH_CREATE	44
ES_EVENT_TYPE_AUTH_SETATTRLIST	45
ES_EVENT_TYPE_AUTH_SETEXTATTR	46
ES_EVENT_TYPE_AUTH_SETFLAGS	47
ES_EVENT_TYPE_AUTH_SETMODE	48
ES_EVENT_TYPE_AUTH_SETOWNER	49
ES_EVENT_TYPE_AUTH_CHDIR	50	The following events are available beginning in macOS 10.15.1
ES_EVENT_TYPE_NOTIFY_CHDIR	51
ES_EVENT_TYPE_AUTH_GETATTRLIST	52
ES_EVENT_TYPE_NOTIFY_GETATTRLIST	53
ES_EVENT_TYPE_NOTIFY_STAT	54
ES_EVENT_TYPE_NOTIFY_ACCESS	55
ES_EVENT_TYPE_AUTH_CHROOT	56
ES_EVENT_TYPE_NOTIFY_CHROOT	57
ES_EVENT_TYPE_AUTH_UTIMES	58
ES_EVENT_TYPE_NOTIFY_UTIMES	59
ES_EVENT_TYPE_AUTH_CLONE	60
ES_EVENT_TYPE_NOTIFY_CLONE	61
ES_EVENT_TYPE_NOTIFY_FCNTL	62
ES_EVENT_TYPE_AUTH_GETEXTATTR	63
ES_EVENT_TYPE_NOTIFY_GETEXTATTR	64
ES_EVENT_TYPE_AUTH_LISTEXTATTR	65
ES_EVENT_TYPE_NOTIFY_LISTEXTATTR	66
ES_EVENT_TYPE_AUTH_READDIR	67
ES_EVENT_TYPE_NOTIFY_READDIR	68
ES_EVENT_TYPE_AUTH_DELETEEXTATTR	69
ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR	70
ES_EVENT_TYPE_AUTH_FSGETPATH	71
ES_EVENT_TYPE_NOTIFY_FSGETPATH	72
ES_EVENT_TYPE_NOTIFY_DUP	73
ES_EVENT_TYPE_AUTH_SETTIME	74
ES_EVENT_TYPE_NOTIFY_SETTIME	75
ES_EVENT_TYPE_NOTIFY_UIPC_BIND	76
ES_EVENT_TYPE_AUTH_UIPC_BIND	77
ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT	78
ES_EVENT_TYPE_AUTH_UIPC_CONNECT	79
ES_EVENT_TYPE_AUTH_EXCHANGEDATA	80
ES_EVENT_TYPE_AUTH_SETACL	81
ES_EVENT_TYPE_NOTIFY_SETACL	82
ES_EVENT_TYPE_NOTIFY_PTY_GRANT	83	The following events are available beginning in macOS 10.15.4
ES_EVENT_TYPE_NOTIFY_PTY_CLOSE	84
ES_EVENT_TYPE_AUTH_PROC_CHECK	85
ES_EVENT_TYPE_NOTIFY_PROC_CHECK	86
ES_EVENT_TYPE_AUTH_GET_TASK	87
ES_EVENT_TYPE_AUTH_SEARCHFS	88	The following events are available beginning in macOS 11.0
ES_EVENT_TYPE_NOTIFY_SEARCHFS	89
ES_EVENT_TYPE_AUTH_FCNTL	90
ES_EVENT_TYPE_AUTH_IOKIT_OPEN	91
ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME	92
ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME	93
ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED	94
ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME	95
ES_EVENT_TYPE_NOTIFY_TRACE	96
ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE	97
ES_EVENT_TYPE_AUTH_REMOUNT	98
ES_EVENT_TYPE_NOTIFY_REMOUNT	99
ES_EVENT_TYPE_AUTH_GET_TASK_READ	100	The following events are available beginning in macOS 11.3
ES_EVENT_TYPE_NOTIFY_GET_TASK_READ	101
ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT	102
ES_EVENT_TYPE_NOTIFY_SETUID	103	The following events are available beginning in macOS 12.0
ES_EVENT_TYPE_NOTIFY_SETGID	104
ES_EVENT_TYPE_NOTIFY_SETEUID	105
ES_EVENT_TYPE_NOTIFY_SETEGID	106
ES_EVENT_TYPE_NOTIFY_SETREUID	107
ES_EVENT_TYPE_NOTIFY_SETREGID	108
ES_EVENT_TYPE_AUTH_COPYFILE	109
ES_EVENT_TYPE_NOTIFY_COPYFILE	110
ES_EVENT_TYPE_NOTIFY_AUTHENTICATION	111	The following events are available beginning in macOS 13.0
ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED	112
ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED	113
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN	114
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT	115
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK	116
ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK	117
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH	118
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH	119
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN	120
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT	121
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN	122
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT	123
ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD	124
ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE	125
ES_EVENT_TYPE_NOTIFY_PROFILE_ADD	126	The following events are available beginning in macOS 14.0
ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE	127
ES_EVENT_TYPE_NOTIFY_SU	128
ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION	129
ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT	130
ES_EVENT_TYPE_NOTIFY_SUDO	131
ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD	132
ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE	133
ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET	134
ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD	135
ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER	136
ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER	137
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD	138
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE	139
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET	140
ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER	141
ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP	142
ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER	143
ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP	144
ES_EVENT_TYPE_NOTIFY_XPC_CONNECT	145
ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE	146	The following events are available beginning in macOS 15.0
ES_EVENT_TYPE_NOTIFY_TCC_MODIFY	147	The following events are available beginning in macOS 15.4
ES_EVENT_TYPE_RESERVED_0	148
ES_EVENT_TYPE_RESERVED_1	149
ES_EVENT_TYPE_RESERVED_2	150
ES_EVENT_TYPE_RESERVED_3	151
ES_EVENT_TYPE_RESERVED_4	152
ES_EVENT_TYPE_RESERVED_5	153
ES_EVENT_TYPE_RESERVED_6	154
ES_EVENT_TYPE_LAST	155	ES_EVENT_TYPE_LAST is not a valid event type but a convenience value for operating on the range of defined event types. This value may change between releases and was available beginning in macOS 10.15

typedefes_event_type_t

typedef enum es_event_type_t es_event_type_t;

enumes_auth_result_t

@brief Valid authorization values to be used when responding to a es_message_t auth event

underlying type unsigned int

ES_AUTH_RESULT_ALLOW	0	The event is authorized and should be allowed to continue
ES_AUTH_RESULT_DENY	1	The event is not authorized and should be blocked

typedefes_auth_result_t

typedef enum es_auth_result_t es_auth_result_t;

enumes_result_type_t

@brief Valid values for the result_type of es_result_t to indicate the appropriate union member to use

underlying type unsigned int

ES_RESULT_TYPE_AUTH	0	The result is an auth result
ES_RESULT_TYPE_FLAGS	1	The result is a flags result

typedefes_result_type_t

typedef enum es_result_type_t es_result_type_t;

enumes_return_t

@brief Return value for functions that can only fail in one way

underlying type unsigned int

ES_RETURN_SUCCESS	0
ES_RETURN_ERROR	1

typedefes_return_t

typedef enum es_return_t es_return_t;

enumes_respond_result_t

@brief Error conditions for responding to a message

underlying type unsigned int

ES_RESPOND_RESULT_SUCCESS	0
ES_RESPOND_RESULT_ERR_INVALID_ARGUMENT	1	One or more invalid arguments were provided
ES_RESPOND_RESULT_ERR_INTERNAL	2	Communication with the ES subsystem failed
ES_RESPOND_RESULT_NOT_FOUND	3	The message being responded to could not be found
ES_RESPOND_RESULT_ERR_DUPLICATE_RESPONSE	4	The provided message has been responded to more than once
ES_RESPOND_RESULT_ERR_EVENT_TYPE	5	Either an inappropriate response API was used for the event type (ensure using proper es_respond_auth_result or es_respond_flags_result function) or the event is notification only.

typedefes_respond_result_t

typedef enum es_respond_result_t es_respond_result_t;

enumes_new_client_result_t

@brief Error conditions for creating a new client

underlying type unsigned int

ES_NEW_CLIENT_RESULT_SUCCESS	0
ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT	1	One or more invalid arguments were provided.
ES_NEW_CLIENT_RESULT_ERR_INTERNAL	2	Communication with the ES subsystem failed, or other error condition.
ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED	3	The caller is not properly entitled to connect.
ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED	4	The caller lacks Transparency, Consent, and Control (TCC) approval from the user.
ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED	5	The caller is not running as root.
ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS	6	The caller has reached the maximum number of allowed simultaneously connected clients.

typedefes_new_client_result_t

typedef enum es_new_client_result_t es_new_client_result_t;

enumes_clear_cache_result_t

@brief Error conditions for clearing the authorisation caches

underlying type unsigned int

ES_CLEAR_CACHE_RESULT_SUCCESS	0
ES_CLEAR_CACHE_RESULT_ERR_INTERNAL	1	Communication with the ES subsystem failed
ES_CLEAR_CACHE_RESULT_ERR_THROTTLE	2	Rate of calls is too high. Slow down.

typedefes_clear_cache_result_t

typedef enum es_clear_cache_result_t es_clear_cache_result_t;

typedefes_cdhash_t

@brief Binary CDHash The Code Directory Hash (CDHash) is a hash of hashes, covering a macho or an entire application bundle. The Code Directory contains the hash of each executable page in the main executable. Only when: - The subject process has opted into the hardened runtime (CS_HARD/CS_KILL) - The subject process is not being debugged - The subject process is running is it guaranteed that the ES provided cdhash value matches the binary observed by the kernel and that the pages actually executed have not been modified.

typedef uint8_t es_cdhash_t[20]

typedefes_sha256_t

@brief Binary Sha256 Digest

typedef uint8_t es_sha256_t[32]

structes_token_t

@brief Structure buffer with size

size 16, align 8

size_t	size	Size of the `data` field in bytes
const uint8_t *	data

typedefes_token_t

typedef struct es_token_t es_token_t;

structes_string_token_t

@brief Structure for handling strings

size 16, align 8

size_t	length	Length of the `data` field. Equivalent to strlen().
const char *	data

typedefes_string_token_t

typedef struct es_string_token_t es_string_token_t;

enumes_mute_path_type_t

@brief Values that will be paired with path strings to describe the type of the path @note : Be careful with symlinks, muting happens AFTER symlink resolution. muting '/tmp' won't work because it's a symlink to '/private/tmp'

underlying type unsigned int

ES_MUTE_PATH_TYPE_PREFIX	0	Value to describe a prefix for the path to the instigating program eg `/bin` would match `/bin/ls` and `/bin/sleep` This is a type of program muting. It could match multiple proccesses
ES_MUTE_PATH_TYPE_LITERAL	1	Value to describe the exact path to the instigating program must match exactly eg `/bin/ls`would match `/bin/ls` but NOT match `/bin/lsa`
ES_MUTE_PATH_TYPE_TARGET_PREFIX	2	Value to describe a target path prefix target here has a very specific meaning @see es_mute_path() briefly, this type of muting matches the argument(s) to syscalls, rather than the instigating program prefix matching means `/private/tmp` would match `open(/private/tmp/cake)`
ES_MUTE_PATH_TYPE_TARGET_LITERAL	3	Value to describe a target path literal Behaves just like ES_MUTE_PATH_TYPE_TARGET_PREFIX except that the target path must match exactly eg `/private/tmp/foo` would match `open(/private/tmp/foo)` but NOT match `open(/private/tmp/foobar)`

typedefes_mute_path_type_t

typedef enum es_mute_path_type_t es_mute_path_type_t;

structes_muted_path_t

Structure to describe attributes of a muted path. @field type Indicates if the path is a prefix or literal, and what type of muting applies. @field event_count The number of events contained in the `events` array. @field events Array of event types for which the path is muted. @field path The muted path. (Note: es_string_token_t is a char array and length)

size 40, align 8

es_mute_path_type_t	type
size_t	event_count
const es_event_type_t *	events
es_string_token_t	path

typedefes_muted_path_t

typedef struct es_muted_path_t es_muted_path_t;

structes_muted_paths_t

Structure for a set of muted paths. @field count The number of elements in the `paths` array. @field paths Array of muted paths.

size 16, align 8

size_t	count
const es_muted_path_t *	paths

typedefes_muted_paths_t

typedef struct es_muted_paths_t es_muted_paths_t;

structes_muted_process_t

Structure to describe attributes of a muted process. @field token The audit token of a muted process. @field event_count The number of events contained in the `events` array. @field events Array of event types for which the process is muted.

size 48, align 8

audit_token_t	audit_token
size_t	event_count
const es_event_type_t *	events

typedefes_muted_process_t

typedef struct es_muted_process_t es_muted_process_t;

structes_muted_processes_t

Structure for a set of muted processes. @field count The number of elements in the `processes` array. @field processes Array of muted processes.

size 16, align 8

size_t	count
const es_muted_process_t *	processes

typedefes_muted_processes_t

typedef struct es_muted_processes_t es_muted_processes_t;

enumes_address_type_t

Type of a network address.

underlying type unsigned int

ES_ADDRESS_TYPE_NONE	0	No source address available.
ES_ADDRESS_TYPE_IPV4	1	Source address is IPv4.
ES_ADDRESS_TYPE_IPV6	2	Source address is IPv6.
ES_ADDRESS_TYPE_NAMED_SOCKET	3	Source address is named UNIX socket.

typedefes_address_type_t

typedef enum es_address_type_t es_address_type_t;

enumes_mute_inversion_type_t

underlying type unsigned int

ES_MUTE_INVERSION_TYPE_PROCESS	0
ES_MUTE_INVERSION_TYPE_PATH	1
ES_MUTE_INVERSION_TYPE_TARGET_PATH	2
ES_MUTE_INVERSION_TYPE_LAST	3

typedefes_mute_inversion_type_t

typedef enum es_mute_inversion_type_t es_mute_inversion_type_t;

enumes_mute_inverted_return_t

underlying type unsigned int

ES_MUTE_INVERTED	0	The type of muted queried was inverted
ES_MUTE_NOT_INVERTED	1	The type of muted queried was not inverted
ES_MUTE_INVERTED_ERROR	2	There was an error querying mute inversion state

typedefes_mute_inverted_return_t

typedef enum es_mute_inverted_return_t es_mute_inverted_return_t;

enumes_authorization_rule_class_t

The class of rules used to evaluate the petition for a specific authorization right

underlying type unsigned int

ES_AUTHORIZATION_RULE_CLASS_USER	0	Right is judged on user properties
ES_AUTHORIZATION_RULE_CLASS_RULE	1	Right is judged by a tree of sub-rules
ES_AUTHORIZATION_RULE_CLASS_MECHANISM	2	Right is judged by one or more plugins
ES_AUTHORIZATION_RULE_CLASS_ALLOW	3	Right is always granted
ES_AUTHORIZATION_RULE_CLASS_DENY	4	Right is always denied
ES_AUTHORIZATION_RULE_CLASS_UNKNOWN	5	Right is unknown
ES_AUTHORIZATION_RULE_CLASS_INVALID	6	Right is invalid

typedefes_authorization_rule_class_t

typedef enum es_authorization_rule_class_t es_authorization_rule_class_t;

enumes_od_member_type_t

The following types are used in OpenDirectory (od) events Type of a group member

underlying type unsigned int

ES_OD_MEMBER_TYPE_USER_NAME	0	Group member is a user, designated by name
ES_OD_MEMBER_TYPE_USER_UUID	1	Group member is a user, designated by UUID
ES_OD_MEMBER_TYPE_GROUP_UUID	2	Group member is another group, designated by UUID

typedefes_od_member_type_t

typedef enum es_od_member_type_t es_od_member_type_t;

enumes_od_account_type_t

Type of an account

underlying type unsigned int

ES_OD_ACCOUNT_TYPE_USER	0
ES_OD_ACCOUNT_TYPE_COMPUTER	1

typedefes_od_account_type_t

typedef enum es_od_account_type_t es_od_account_type_t;

enumes_od_record_type_t

Type of a record

underlying type unsigned int

ES_OD_RECORD_TYPE_USER	0
ES_OD_RECORD_TYPE_GROUP	1

typedefes_od_record_type_t

typedef enum es_od_record_type_t es_od_record_type_t;

enumes_gatekeeper_user_override_file_type_t

underlying type unsigned int

ES_GATEKEEPER_USER_OVERRIDE_FILE_TYPE_PATH	0	Signals that file is a string of a path since file could not be resolved on disk at time of event submission
ES_GATEKEEPER_USER_OVERRIDE_FILE_TYPE_FILE	1	Signals that file is a es_file_t

typedefes_gatekeeper_user_override_file_type_t

typedef enum es_gatekeeper_user_override_file_type_t es_gatekeeper_user_override_file_type_t;

structes_signed_file_info_t

Information from a signed file. If the file is a multiarchitecture binary, only the signing information for the native host architecture is reported. I.e. the CDHash from the AArch64 slice if the host is AArch64. @field cdhash Code Directory Hash @field teamID Team Identifier, if available in the signing information. @field signingID Signing Identifier, if available in the signing information.

size 56, align 8

es_cdhash_t	cdhash
es_string_token_t	signing_id
es_string_token_t	team_id

typedefes_signed_file_info_t

typedef struct es_signed_file_info_t es_signed_file_info_t;

enumes_tcc_event_type_t

@typedef ess_tcc_event_type_t Represent the type of TCC modification event. - ES_TCC_EVENT_TYPE_UNKNOWN: Unknown prior state. - ES_TCC_EVENT_TYPE_CREATE: A new TCC authorization record was created. - ES_TCC_EVENT_TYPE_MODIFY: An existing TCC authorization record was modified. - ES_TCC_EVENT_TYPE_DELETE: An existing TCC authorization record was deleted.

underlying type unsigned int

ES_TCC_EVENT_TYPE_UNKNOWN	0
ES_TCC_EVENT_TYPE_CREATE	1
ES_TCC_EVENT_TYPE_MODIFY	2
ES_TCC_EVENT_TYPE_DELETE	3

typedefes_tcc_event_type_t

typedef enum es_tcc_event_type_t es_tcc_event_type_t;

enumes_tcc_authorization_right_t

ess_tcc_authorization_right_t Represents the type of authorization permission an application has to a TCC Service.

underlying type unsigned int

ES_TCC_AUTHORIZATION_RIGHT_DENIED	0	0
ES_TCC_AUTHORIZATION_RIGHT_UNKNOWN	1	1
ES_TCC_AUTHORIZATION_RIGHT_ALLOWED	2	2
ES_TCC_AUTHORIZATION_RIGHT_LIMITED	3	3
ES_TCC_AUTHORIZATION_RIGHT_ADD_MODIFY_ADDED	4	4
ES_TCC_AUTHORIZATION_RIGHT_SESSION_PID	5	5
ES_TCC_AUTHORIZATION_RIGHT_LEARN_MORE	6	6

typedefes_tcc_authorization_right_t

typedef enum es_tcc_authorization_right_t es_tcc_authorization_right_t;

enumes_tcc_authorization_reason_t

ess_tcc_authorization_reason_t Represents the reason a TCC permission was updated.

underlying type unsigned int

ES_TCC_AUTHORIZATION_REASON_NONE	0
ES_TCC_AUTHORIZATION_REASON_ERROR	1
ES_TCC_AUTHORIZATION_REASON_USER_CONSENT	2	User answered a prompt
ES_TCC_AUTHORIZATION_REASON_USER_SET	3	User changed the authorization right via Preferences
ES_TCC_AUTHORIZATION_REASON_SYSTEM_SET	4	A system process changed the authorization right
ES_TCC_AUTHORIZATION_REASON_SERVICE_POLICY	5
ES_TCC_AUTHORIZATION_REASON_MDM_POLICY	6
ES_TCC_AUTHORIZATION_REASON_SERVICE_OVERRIDE_POLICY	7
ES_TCC_AUTHORIZATION_REASON_MISSING_USAGE_STRING	8
ES_TCC_AUTHORIZATION_REASON_PROMPT_TIMEOUT	9
ES_TCC_AUTHORIZATION_REASON_PREFLIGHT_UNKNOWN	10
ES_TCC_AUTHORIZATION_REASON_ENTITLED	11
ES_TCC_AUTHORIZATION_REASON_APP_TYPE_POLICY	12
ES_TCC_AUTHORIZATION_REASON_PROMPT_CANCEL	13

typedefes_tcc_authorization_reason_t

typedef enum es_tcc_authorization_reason_t es_tcc_authorization_reason_t;

enumes_tcc_identity_type_t

es_tcc_identity_type_t Represent the identity type of an application which has access to a TCC service.

underlying type unsigned int

ES_TCC_IDENTITY_TYPE_BUNDLE_ID	0
ES_TCC_IDENTITY_TYPE_EXECUTABLE_PATH	1
ES_TCC_IDENTITY_TYPE_POLICY_ID	2
ES_TCC_IDENTITY_TYPE_FILE_PROVIDER_DOMAIN_ID	3

typedefes_tcc_identity_type_t

typedef enum es_tcc_identity_type_t es_tcc_identity_type_t;

enumes_cs_validation_category_t

es_cs_validation_category Indicates the code signature validation policy that was applied to a binary

underlying type unsigned int

ES_CS_VALIDATION_CATEGORY_INVALID	0
ES_CS_VALIDATION_CATEGORY_PLATFORM	1
ES_CS_VALIDATION_CATEGORY_TESTFLIGHT	2
ES_CS_VALIDATION_CATEGORY_DEVELOPMENT	3
ES_CS_VALIDATION_CATEGORY_APP_STORE	4
ES_CS_VALIDATION_CATEGORY_ENTERPRISE	5
ES_CS_VALIDATION_CATEGORY_DEVELOPER_ID	6
ES_CS_VALIDATION_CATEGORY_LOCAL_SIGNING	7
ES_CS_VALIDATION_CATEGORY_ROSETTA	8
ES_CS_VALIDATION_CATEGORY_OOPJIT	9
ES_CS_VALIDATION_CATEGORY_NONE	10

typedefes_cs_validation_category_t

typedef enum es_cs_validation_category_t es_cs_validation_category_t;

enumes_auto_unlock_type_t

es_auto_unlock_type_t See es_event_authentication_auto_unlock_t

underlying type unsigned int

ES_AUTO_UNLOCK_MACHINE_UNLOCK	1	Unlock the machine using Apple Watch.
ES_AUTO_UNLOCK_AUTH_PROMPT	2	Approve an authorization prompt using Apple Watch.

typedefes_auto_unlock_type_t

typedef enum es_auto_unlock_type_t es_auto_unlock_type_t;

enumes_btm_item_type_t

es_btm_item_type_t See es_btm_launch_item_t

underlying type unsigned int

ES_BTM_ITEM_TYPE_USER_ITEM	0
ES_BTM_ITEM_TYPE_APP	1
ES_BTM_ITEM_TYPE_LOGIN_ITEM	2
ES_BTM_ITEM_TYPE_AGENT	3
ES_BTM_ITEM_TYPE_DAEMON	4

typedefes_btm_item_type_t

typedef enum es_btm_item_type_t es_btm_item_type_t;

enumes_destination_type_t

es_destination_type_t See es_event_create_t / es_event_rename_t

underlying type unsigned int

ES_DESTINATION_TYPE_EXISTING_FILE	0
ES_DESTINATION_TYPE_NEW_PATH	1

typedefes_destination_type_t

typedef enum es_destination_type_t es_destination_type_t;

enumes_get_task_type_t

es_get_task_type_t See es_event_get_task_t

underlying type unsigned int

ES_GET_TASK_TYPE_TASK_FOR_PID	0	Task port obtained by calling e.g. task_for_pid(), where the caller obtains a task port for a process identified by pid.
ES_GET_TASK_TYPE_EXPOSE_TASK	1	Task port obtained by calling e.g. processor_set_tasks(), where the caller obtains a set of task ports.
ES_GET_TASK_TYPE_IDENTITY_TOKEN	2	Task port obtained by calling e.g. task_identity_token_get_task_port(), where the caller obtains a task port for a process identified by an identity token. Task identity tokens generally have to be given up by the target process voluntarily prior to the conversion into task ports.

typedefes_get_task_type_t

typedef enum es_get_task_type_t es_get_task_type_t;

enumes_openssh_login_result_type_t

es_openssh_login_result_type_t See es_event_openssh_login_t

underlying type unsigned int

ES_OPENSSH_LOGIN_EXCEED_MAXTRIES	0
ES_OPENSSH_LOGIN_ROOT_DENIED	1
ES_OPENSSH_AUTH_SUCCESS	2
ES_OPENSSH_AUTH_FAIL_NONE	3
ES_OPENSSH_AUTH_FAIL_PASSWD	4
ES_OPENSSH_AUTH_FAIL_KBDINT	5
ES_OPENSSH_AUTH_FAIL_PUBKEY	6
ES_OPENSSH_AUTH_FAIL_HOSTBASED	7
ES_OPENSSH_AUTH_FAIL_GSSAPI	8
ES_OPENSSH_INVALID_USER	9

typedefes_openssh_login_result_type_t

typedef enum es_openssh_login_result_type_t es_openssh_login_result_type_t;

enumes_mount_disposition_t

es_mount_disposition_t See es_event_mount_t

underlying type unsigned int

ES_MOUNT_DISPOSITION_EXTERNAL	0	device is external storage
ES_MOUNT_DISPOSITION_INTERNAL	1	device is internal storage
ES_MOUNT_DISPOSITION_NETWORK	2	device is a network share
ES_MOUNT_DISPOSITION_VIRTUAL	3	device is virtual (dmg or file)
ES_MOUNT_DISPOSITION_NULLFS	4	mount uses nullfs, commonly for app translocation
ES_MOUNT_DISPOSITION_UNKNOWN	5	unable to determine disposition

typedefes_mount_disposition_t

typedef enum es_mount_disposition_t es_mount_disposition_t;

enumes_proc_suspend_resume_type_t

@brief This enum describes the type of suspend/resume operations that are currently used.

underlying type unsigned int

ES_PROC_SUSPEND_RESUME_TYPE_SUSPEND	0
ES_PROC_SUSPEND_RESUME_TYPE_RESUME	1
ES_PROC_SUSPEND_RESUME_TYPE_SHUTDOWN_SOCKETS	3

typedefes_proc_suspend_resume_type_t

typedef enum es_proc_suspend_resume_type_t es_proc_suspend_resume_type_t;

enumes_profile_source_t

es_profile_source_t See es_profile_t

underlying type unsigned int

ES_PROFILE_SOURCE_MANAGED	0
ES_PROFILE_SOURCE_INSTALL	1

typedefes_profile_source_t

typedef enum es_profile_source_t es_profile_source_t;

enumes_touchid_mode_t

es_touchid_mode_t See es_event_authentication_touchid_t

underlying type unsigned int

ES_TOUCHID_MODE_VERIFICATION	0
ES_TOUCHID_MODE_IDENTIFICATION	1

typedefes_touchid_mode_t

typedef enum es_touchid_mode_t es_touchid_mode_t;

EndpointSecurity/ESTypes.h

structes_event_id_t

typedefes_event_id_t

enumes_action_type_t

typedefes_action_type_t

enumes_set_or_clear_t

typedefes_set_or_clear_t

enumes_proc_check_type_t

typedefes_proc_check_type_t

enumes_xpc_domain_type_t

typedefes_xpc_domain_type_t

enumes_authentication_type_t

typedefes_authentication_type_t

enumes_sudo_plugin_type_t

typedefes_sudo_plugin_type_t

enumes_event_type_t

typedefes_event_type_t

enumes_auth_result_t

typedefes_auth_result_t

enumes_result_type_t

typedefes_result_type_t

enumes_return_t

typedefes_return_t

enumes_respond_result_t

typedefes_respond_result_t

enumes_new_client_result_t

typedefes_new_client_result_t

enumes_clear_cache_result_t

typedefes_clear_cache_result_t

typedefes_cdhash_t

typedefes_sha256_t

structes_token_t

typedefes_token_t

structes_string_token_t

typedefes_string_token_t

enumes_mute_path_type_t

typedefes_mute_path_type_t

structes_muted_path_t

typedefes_muted_path_t

structes_muted_paths_t

typedefes_muted_paths_t

structes_muted_process_t

typedefes_muted_process_t

structes_muted_processes_t

typedefes_muted_processes_t

enumes_address_type_t

typedefes_address_type_t

enumes_mute_inversion_type_t

typedefes_mute_inversion_type_t

enumes_mute_inverted_return_t

typedefes_mute_inverted_return_t

enumes_authorization_rule_class_t

typedefes_authorization_rule_class_t

enumes_od_member_type_t

typedefes_od_member_type_t

enumes_od_account_type_t

typedefes_od_account_type_t

enumes_od_record_type_t

typedefes_od_record_type_t

enumes_gatekeeper_user_override_file_type_t

typedefes_gatekeeper_user_override_file_type_t

structes_signed_file_info_t

typedefes_signed_file_info_t

enumes_tcc_event_type_t

typedefes_tcc_event_type_t

enumes_tcc_authorization_right_t

typedefes_tcc_authorization_right_t

enumes_tcc_authorization_reason_t

typedefes_tcc_authorization_reason_t

enumes_tcc_identity_type_t

typedefes_tcc_identity_type_t

enumes_cs_validation_category_t

typedefes_cs_validation_category_t

enumes_auto_unlock_type_t

typedefes_auto_unlock_type_t

enumes_btm_item_type_t

typedefes_btm_item_type_t

enumes_destination_type_t

typedefes_destination_type_t

enumes_get_task_type_t