Endpoint Security on macOS: Building EDR the Apple Way

Every process launch, every file open, every memory mapping, every kernel extension load on a modern Mac can be inspected before it happens — if you hold the entitlement Apple grants only to vetted security vendors. This book explains what that entitlement enables, how the Endpoint Security framework delivers over 150 event types to userspace, and how to build a functioning EDR on top of it.

It wal...