macOS telemetry sources

Functional-domain sections

The ESF catalog groups its 148 event types (44 AUTH / 104 NOTIFY) into the sections below. The first 15 (111 event types) are Apple's own documentation sections for kernel-level events. The remaining 13 (37 event types) group the user-space security events Apple doesn't document in a section, by their es_event_<family>_* struct family.

Apple documentation sections

Section	Description	Event types	Samples	Rules
File System	File open, close, create, write, rename, clone, copy, truncate, lookup, and access operations.	23	15	4
File Metadata	Reads and changes of file metadata: mode, owner, ACLs, extended attributes, flags, timestamps, and directory listings.	27	13	0
File Provider	File Provider extension materialization and update of placeholder items.	4	0	0
Symbolic Link	Link creation, unlink, and symbolic-link resolution.	6	4	1
File System Mounting	Filesystem mount, unmount, and remount.	5	3	0
Memory Mapping	Mapping a file into memory and changing page protections (writable-to-executable transitions).	4	4	0
Process	Process execution, fork, exit, signalling, process inspection, and chdir/chroot.	12	10	3
Interprocess	Cross-process actions: suspend/resume, ptrace-style tracing, and remote thread creation.	4	2	0
Task Port	Acquisition of another process's Mach task port (control, name, read, inspect).	6	0	0
User and Group ID	Real and effective user- and group-ID changes (privilege transitions).	6	0	0
Code Signing	Invalidation of a running process's dynamic code signature.	1	0	0
Socket	UNIX-domain socket bind and connect. (ESF has no IP network-connection event.)	4	0	0
Clock	System clock changes.	2	0	0
Kernel	Kernel-extension load/unload and IOKit user-client open.	5	0	2
PTY	PTY grant and close.	2	0	0

Catalog groupings (events Apple does not document in a section)

Section	Description	Event types	Samples	Rules
OpenSSH	OpenSSH (sshd) login and logout, with authentication result and source address.	2	0	0
XPC	XPC service connection requests.	1	1	1
Authentication	Local authentication attempts and the su / sudo privilege-elevation utilities.	3	1	1
Login Window	loginwindow GUI session login, logout, lock, and unlock.	4	0	0
Screen Sharing	Screen Sharing (VNC) session attach and detach.	2	0	0
Login	Console login(1) authentication login and logout.	2	0	0
Authorization	Security Authorization Services right petitions and the system's judgement.	2	0	0
Open Directory	Open Directory user/group creation, deletion, membership, password, and attribute changes.	13	4	0
XProtect	XProtect malware detection and remediation.	2	0	0
Background Task Management	Background Task Management (BTM) launch- and login-item add/remove (persistence).	2	0	0
Profile	Configuration-profile installation and removal.	2	0	0
Gatekeeper	User override of a Gatekeeper block to run quarantined software.	1	0	0
TCC	Transparency, Consent & Control (TCC) privacy-permission changes.	1	0	1

The ESF event model

A client subscribes to a set of es_event_type_t values and receives an es_message_t for each matching action. Every message carries a common header (the acting process, timestamp, and Mach absolute time) plus an event-specific payload union (for example es_event_exec_t for an execution, es_event_open_t for a file open). The event type names the payload. The payload carries the detail a detection keys on.

AUTH and NOTIFY events

Each event type belongs to one of two families. A NOTIFY event is fire-and-forget: the kernel reports that an action happened and does not wait. An AUTH event is a synchronous authorization request: the kernel blocks until a subscribed client returns allow or deny (subject to a deadline), so only an active enforcement agent (for example a security product, or Gatekeeper) responds to it. Detection telemetry typically subscribes to the NOTIFY family. The catalog lists both (44 AUTH, 104 NOTIFY) with an AUTH/NOTIFY column per event.

User-space event sources

The earliest ESF events come from the XNU kernel. Starting with macOS 13 Ventura, Apple added event types that user-space frameworks emit instead: Background Task Management (BTM) launch items, XProtect malware events, OpenDirectory changes, sudo, and SSH login and logout. These widen coverage of persistence and identity activity, with a different trust and availability model than the kernel-sourced events. Apple's documentation leaves them outside its functional-domain sections, so the Catalog groupings table above lists them by struct family.

References

Event-type names: Apple Developer: es_event_type_t: the event-type enum and the AUTH/NOTIFY action distinction.
Field names: Apple Developer: es_events_t: the per-event payload structs whose members are the field names.
Apple Developer: Event Types: the Endpoint Security event-type collection.
Red Canary mac-monitor: ES User Space Eventing: the user-space event sources (macOS 13+).