Endpoint Security In a macOS World

This document provides a high-level and practical deep dive into Apple’s macOS Endpoint Security (ES) API introduced with Catalina, explaining system extensions, required entitlements and code signing, user approval/Full Disk Access considerations, and the distinction between NOTIFY and AUTH events for detection and prevention. It outlines how detection engineers can leverage ES telemetry with rules (e.g., Sigma/NSPredicate), demonstrates available tooling (eslogger, ESFPlayground, Appmon), and illustrates the value of exec-event visibility with an example, positioning ES as a foundational capability for macOS defensive tooling.