Skip to main content
Release

esmat: New Free macOS Endpoint Security Message Analysis Tool

  • by Helge Klein
  • February 2, 2022

We’re happy to announce the public release of esmat, a new free & open-source tool. esmat is a command-line app for macOS that allows you to explore the behavior of Apple’s Endpoint Security framework.

What Is the Apple Endpoint Security Framework?

Apple introduced the Endpoint Security framework (ESF) with macOS 10.15 (Catalina). Endpoint Security is an API for monitoring system events that may indicate malicious activity, such as process execution. The framework’s event types cover file system and process activity, memory mapping, interprocess communication, and changes to users/groups, to name a few.

Authorization vs. Notification

Endpoint Security can operate in two modes: authorization and notification. Authorization events are synchronous and can be used to block operations (e.g., the execution of a process). Notification events are asynchronous and can only be used to observe, not to block. The es_event_type_t enumeration lists all available authorization and notification event types.

What Does Esmat Do?

Esmat subscribes to Endpoint Security event types specified by the user. Once started, it works like a stopwatch: every time you press Ctrl+T, it prints statistics about monitored executables and event types. The above screenshot shows an excerpt from the statistics printout.

Use Cases

Esmat has two primary use cases:

  1. Investigate process behavior and child process creation.
  2. Analyze the capabilities of the Endpoint Security framework (ESF).

Download and Documentation

Head over to esmat’s GitHub repository for the documentation, and download esmat from the releases page.

About uberAgent

uberAgent is an innovative Windows and macOS user experience monitoring (UXM) and endpoint security analytics (ESA) product. UXM highlights include detailed information about boot and logon duration, application unresponsiveness detection, network reliability drill-downs, process startup duration, application usage metering, browser performance, web app metrics, and Citrix insights. ESA comes with a sophisticated activity monitoring engine, the uAQL query language, detection of risky activity, DNS query monitoring, hash calculation, registry monitoring, and Authenticode signature verification.

About vast limits

vast limits GmbH is the company behind uberAgent, the innovative user experience monitoring and endpoint security analytics product. vast limits’ customer list includes organizations from industries like finance, healthcare, professional services, and education, ranging from medium-sized businesses to global enterprises. vast limits’ network of qualified solution partners ensures best-in-class service and support anywhere in the world.

Comments

Your email address will not be published. Required fields are marked *