EndpointSecurity(7)

NAME
EndpointSecurity - APIs for applications to implement system security policy

DESCRIPTION
The EndpointSecurity (ES) subsystem is a set of functionality to expose security relevant system events to applications (ES clients). ES clients can either be standalone applications/executables or installed as system extensions.

If the ES client is a system extension, the following optional Boolean keys can be set in the bundle's Info.plist:

NSEndpointSecurityEarlyBoot
    If set to TRUE, the ES subsystem will hold up all third party executions (anything that is not a platform binary) until all early boot ES extensions make their first subscription.

NSEndpointSecurityRebootRequired
    If not set or set to FALSE, the new version of the extension is started immediately after terminating the old version.

    If set to TRUE, the new version of the extension is NOT started until the system reboots. When the system reboots, only the new version will be started and the old version will be removed. This ensures there is no gap in monitoring of subscribed events.

SEE ALSO
endpointsecurityd(8), sysextd(8), libEndpointSecurity(3)