How do you know when macOS detects and remediates malware?
&gt; Using eslogger isn’t simple either. That tool has to be left running to gather records of events into a text file, which the user has to monitor and maintain. Using the details I published here previously, I gathered those two event types during my tests using malware samples. Each event generates a substantial quantity of JSON data which appears to be undocumented.<p>It&#x27;s a pretty clear dump of the contents of <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;endpointsecurity&#x2F;e" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;endpointsecurity&#x2F;e</a>..., just like every other endpoint security event. This tool is intended for users who are familiar with the Endpoint Security framework and want quick access to an entitled binary for testing purposes.<p>The author needs to understand that 1. developer APIs exist and are meant for developers, and 2. the OS is never going to be designed to be introspectable to someone like him and his users, because that would be an incredibly stupid way to design an OS. If you want to peek at what is going on, use the existing APIs and package it up as an app for your users to use. Exposing raw events like the author wants is neither useful or actionable for most users.