eslogger enables agentless macOS security monitoring using Endpoint Security

The author investigates monitoring macOS security using eslogger, Apple's built-in command-line tool for the Endpoint Security framework, without relying on third-party agents. By pairing eslogger with a custom filter and Splunk, the setup processes process launches, permissions, and system telemetry while consuming minimal resources. The investigation highlights practical challenges, including high event volume, permission revocation behavior, and specific event classifications like DriverKit extensions. Open article →