---
title: es_events_t
framework: endpointsecurity
role: symbol
role_heading: Structure
path: endpointsecurity/es_events_t
---

# es_events_t

A C union of event-specific types.

## Declaration

```swift
struct es_events_t
```

## Overview

Overview Each event monitored by Endpoint Security delivers different properties to clients. For example, a file-renaming event provides source and target paths, while a process-forking event provides the process identifier of the new child process. This C union represents each kind of event as a unique member, each with a type specific to the kind of data it contains.

## Topics

### File-System Events

- [access](endpointsecurity/es_events_t/access.md)
- [clone](endpointsecurity/es_events_t/clone.md)
- [copyfile](endpointsecurity/es_events_t/copyfile.md)
- [close](endpointsecurity/es_events_t/close.md)
- [create](endpointsecurity/es_events_t/create.md)
- [dup](endpointsecurity/es_events_t/dup.md)
- [exchangedata](endpointsecurity/es_events_t/exchangedata.md)
- [fcntl](endpointsecurity/es_events_t/fcntl.md)
- [open](endpointsecurity/es_events_t/open.md)
- [rename](endpointsecurity/es_events_t/rename.md)
- [write](endpointsecurity/es_events_t/write.md)
- [truncate](endpointsecurity/es_events_t/truncate.md)
- [lookup](endpointsecurity/es_events_t/lookup.md)
- [searchfs](endpointsecurity/es_events_t/searchfs.md)

### File Metadata Events

- [deleteextattr](endpointsecurity/es_events_t/deleteextattr.md)
- [fsgetpath](endpointsecurity/es_events_t/fsgetpath.md)
- [getattrlist](endpointsecurity/es_events_t/getattrlist.md)
- [getextattr](endpointsecurity/es_events_t/getextattr.md)
- [listextattr](endpointsecurity/es_events_t/listextattr.md)
- [readdir](endpointsecurity/es_events_t/readdir.md)
- [setacl](endpointsecurity/es_events_t/setacl.md)
- [setattrlist](endpointsecurity/es_events_t/setattrlist.md)
- [setextattr](endpointsecurity/es_events_t/setextattr.md)
- [setflags](endpointsecurity/es_events_t/setflags.md)
- [setmode](endpointsecurity/es_events_t/setmode.md)
- [setowner](endpointsecurity/es_events_t/setowner.md)
- [stat](endpointsecurity/es_events_t/stat.md)
- [utimes](endpointsecurity/es_events_t/utimes.md)

### File Provider Events

- [file_provider_materialize](endpointsecurity/es_events_t/file_provider_materialize.md)
- [file_provider_update](endpointsecurity/es_events_t/file_provider_update.md)

### Symbolic Link Events

- [link](endpointsecurity/es_events_t/link.md)
- [readlink](endpointsecurity/es_events_t/readlink.md)
- [unlink](endpointsecurity/es_events_t/unlink.md)

### File System Mounting Events

- [mount](endpointsecurity/es_events_t/mount.md)
- [unmount](endpointsecurity/es_events_t/unmount.md)
- [remount](endpointsecurity/es_events_t/remount.md)

### Memory Mapping Events

- [mmap](endpointsecurity/es_events_t/mmap.md)
- [mprotect](endpointsecurity/es_events_t/mprotect.md)

### Process Events

- [chdir](endpointsecurity/es_events_t/chdir.md)
- [chroot](endpointsecurity/es_events_t/chroot.md)
- [exec](endpointsecurity/es_events_t/exec.md)
- [fork](endpointsecurity/es_events_t/fork.md)
- [proc_check](endpointsecurity/es_events_t/proc_check.md)
- [signal](endpointsecurity/es_events_t/signal.md)
- [exit](endpointsecurity/es_events_t/exit.md)

### Interprocess Events

- [proc_suspend_resume](endpointsecurity/es_events_t/proc_suspend_resume.md)
- [trace](endpointsecurity/es_events_t/trace.md)
- [remote_thread_create](endpointsecurity/es_events_t/remote_thread_create.md)

### Task Port Events

- [get_task](endpointsecurity/es_events_t/get_task.md)
- [get_task_read](endpointsecurity/es_events_t/get_task_read.md)
- [get_task_inspect](endpointsecurity/es_events_t/get_task_inspect.md)
- [get_task_name](endpointsecurity/es_events_t/get_task_name.md)

### User and Group ID Events

- [setuid](endpointsecurity/es_events_t/setuid.md)
- [setgid](endpointsecurity/es_events_t/setgid.md)
- [seteuid](endpointsecurity/es_events_t/seteuid.md)
- [setegid](endpointsecurity/es_events_t/setegid.md)
- [setreuid](endpointsecurity/es_events_t/setreuid.md)
- [setregid](endpointsecurity/es_events_t/setregid.md)

### Code Signing Events

- [cs_invalidated](endpointsecurity/es_events_t/cs_invalidated.md)

### Socket Events

- [uipc_bind](endpointsecurity/es_events_t/uipc_bind.md)
- [uipc_connect](endpointsecurity/es_events_t/uipc_connect.md)

### Clock Events

- [settime](endpointsecurity/es_events_t/settime.md)

### Kernel Events

- [iokit_open](endpointsecurity/es_events_t/iokit_open.md)
- [kextload](endpointsecurity/es_events_t/kextload.md)
- [kextunload](endpointsecurity/es_events_t/kextunload.md)

### Pseudoterminal Events

- [pty_close](endpointsecurity/es_events_t/pty_close.md)
- [pty_grant](endpointsecurity/es_events_t/pty_grant.md)

### Initializers

- [init(access:)](endpointsecurity/es_events_t/init(access:).md)
- [init(authentication:)](endpointsecurity/es_events_t/init(authentication:).md)
- [init(authorization_judgement:)](endpointsecurity/es_events_t/init(authorization_judgement:).md)
- [init(authorization_petition:)](endpointsecurity/es_events_t/init(authorization_petition:).md)
- [init(btm_launch_item_add:)](endpointsecurity/es_events_t/init(btm_launch_item_add:).md)
- [init(btm_launch_item_remove:)](endpointsecurity/es_events_t/init(btm_launch_item_remove:).md)
- [init(chdir:)](endpointsecurity/es_events_t/init(chdir:).md)
- [init(chroot:)](endpointsecurity/es_events_t/init(chroot:).md)
- [init(clone:)](endpointsecurity/es_events_t/init(clone:).md)
- [init(close:)](endpointsecurity/es_events_t/init(close:).md)
- [init(copyfile:)](endpointsecurity/es_events_t/init(copyfile:).md)
- [init(create:)](endpointsecurity/es_events_t/init(create:).md)
- [init(cs_invalidated:)](endpointsecurity/es_events_t/init(cs_invalidated:).md)
- [init(deleteextattr:)](endpointsecurity/es_events_t/init(deleteextattr:).md)
- [init(dup:)](endpointsecurity/es_events_t/init(dup:).md)
- [init(exchangedata:)](endpointsecurity/es_events_t/init(exchangedata:).md)
- [init(exec:)](endpointsecurity/es_events_t/init(exec:).md)
- [init(exit:)](endpointsecurity/es_events_t/init(exit:).md)
- [init(fcntl:)](endpointsecurity/es_events_t/init(fcntl:).md)
- [init(file_provider_materialize:)](endpointsecurity/es_events_t/init(file_provider_materialize:).md)
- [init(file_provider_update:)](endpointsecurity/es_events_t/init(file_provider_update:).md)
- [init(fork:)](endpointsecurity/es_events_t/init(fork:).md)
- [init(fsgetpath:)](endpointsecurity/es_events_t/init(fsgetpath:).md)
- [init(gatekeeper_user_override:)](endpointsecurity/es_events_t/init(gatekeeper_user_override:).md)
- [init(get_task:)](endpointsecurity/es_events_t/init(get_task:).md)
- [init(get_task_inspect:)](endpointsecurity/es_events_t/init(get_task_inspect:).md)
- [init(get_task_name:)](endpointsecurity/es_events_t/init(get_task_name:).md)
- [init(get_task_read:)](endpointsecurity/es_events_t/init(get_task_read:).md)
- [init(getattrlist:)](endpointsecurity/es_events_t/init(getattrlist:).md)
- [init(getextattr:)](endpointsecurity/es_events_t/init(getextattr:).md)
- [init(iokit_open:)](endpointsecurity/es_events_t/init(iokit_open:).md)
- [init(kextload:)](endpointsecurity/es_events_t/init(kextload:).md)
- [init(kextunload:)](endpointsecurity/es_events_t/init(kextunload:).md)
- [init(link:)](endpointsecurity/es_events_t/init(link:).md)
- [init(listextattr:)](endpointsecurity/es_events_t/init(listextattr:).md)
- [init(login_login:)](endpointsecurity/es_events_t/init(login_login:).md)
- [init(login_logout:)](endpointsecurity/es_events_t/init(login_logout:).md)
- [init(lookup:)](endpointsecurity/es_events_t/init(lookup:).md)
- [init(lw_session_lock:)](endpointsecurity/es_events_t/init(lw_session_lock:).md)
- [init(lw_session_login:)](endpointsecurity/es_events_t/init(lw_session_login:).md)
- [init(lw_session_logout:)](endpointsecurity/es_events_t/init(lw_session_logout:).md)
- [init(lw_session_unlock:)](endpointsecurity/es_events_t/init(lw_session_unlock:).md)
- [init(mmap:)](endpointsecurity/es_events_t/init(mmap:).md)
- [init(mount:)](endpointsecurity/es_events_t/init(mount:).md)
- [init(mprotect:)](endpointsecurity/es_events_t/init(mprotect:).md)
- [init(od_attribute_set:)](endpointsecurity/es_events_t/init(od_attribute_set:).md)
- [init(od_attribute_value_add:)](endpointsecurity/es_events_t/init(od_attribute_value_add:).md)
- [init(od_attribute_value_remove:)](endpointsecurity/es_events_t/init(od_attribute_value_remove:).md)
- [init(od_create_group:)](endpointsecurity/es_events_t/init(od_create_group:).md)
- [init(od_create_user:)](endpointsecurity/es_events_t/init(od_create_user:).md)
- [init(od_delete_group:)](endpointsecurity/es_events_t/init(od_delete_group:).md)
- [init(od_delete_user:)](endpointsecurity/es_events_t/init(od_delete_user:).md)
- [init(od_disable_user:)](endpointsecurity/es_events_t/init(od_disable_user:).md)
- [init(od_enable_user:)](endpointsecurity/es_events_t/init(od_enable_user:).md)
- [init(od_group_add:)](endpointsecurity/es_events_t/init(od_group_add:).md)
- [init(od_group_remove:)](endpointsecurity/es_events_t/init(od_group_remove:).md)
- [init(od_group_set:)](endpointsecurity/es_events_t/init(od_group_set:).md)
- [init(od_modify_password:)](endpointsecurity/es_events_t/init(od_modify_password:).md)
- [init(open:)](endpointsecurity/es_events_t/init(open:).md)
- [init(openssh_login:)](endpointsecurity/es_events_t/init(openssh_login:).md)
- [init(openssh_logout:)](endpointsecurity/es_events_t/init(openssh_logout:).md)
- [init(proc_check:)](endpointsecurity/es_events_t/init(proc_check:).md)
- [init(proc_suspend_resume:)](endpointsecurity/es_events_t/init(proc_suspend_resume:).md)
- [init(profile_add:)](endpointsecurity/es_events_t/init(profile_add:).md)
- [init(profile_remove:)](endpointsecurity/es_events_t/init(profile_remove:).md)
- [init(pty_close:)](endpointsecurity/es_events_t/init(pty_close:).md)
- [init(pty_grant:)](endpointsecurity/es_events_t/init(pty_grant:).md)
- [init(readdir:)](endpointsecurity/es_events_t/init(readdir:).md)
- [init(readlink:)](endpointsecurity/es_events_t/init(readlink:).md)
- [init(remote_thread_create:)](endpointsecurity/es_events_t/init(remote_thread_create:).md)
- [init(remount:)](endpointsecurity/es_events_t/init(remount:).md)
- [init(rename:)](endpointsecurity/es_events_t/init(rename:).md)
- [init(screensharing_attach:)](endpointsecurity/es_events_t/init(screensharing_attach:).md)
- [init(screensharing_detach:)](endpointsecurity/es_events_t/init(screensharing_detach:).md)
- [init(searchfs:)](endpointsecurity/es_events_t/init(searchfs:).md)
- [init(setacl:)](endpointsecurity/es_events_t/init(setacl:).md)
- [init(setattrlist:)](endpointsecurity/es_events_t/init(setattrlist:).md)
- [init(setegid:)](endpointsecurity/es_events_t/init(setegid:).md)
- [init(seteuid:)](endpointsecurity/es_events_t/init(seteuid:).md)
- [init(setextattr:)](endpointsecurity/es_events_t/init(setextattr:).md)
- [init(setflags:)](endpointsecurity/es_events_t/init(setflags:).md)
- [init(setgid:)](endpointsecurity/es_events_t/init(setgid:).md)
- [init(setmode:)](endpointsecurity/es_events_t/init(setmode:).md)
- [init(setowner:)](endpointsecurity/es_events_t/init(setowner:).md)
- [init(setregid:)](endpointsecurity/es_events_t/init(setregid:).md)
- [init(setreuid:)](endpointsecurity/es_events_t/init(setreuid:).md)
- [init(settime:)](endpointsecurity/es_events_t/init(settime:).md)
- [init(setuid:)](endpointsecurity/es_events_t/init(setuid:).md)
- [init(signal:)](endpointsecurity/es_events_t/init(signal:).md)
- [init(stat:)](endpointsecurity/es_events_t/init(stat:).md)
- [init(su:)](endpointsecurity/es_events_t/init(su:).md)
- [init(sudo:)](endpointsecurity/es_events_t/init(sudo:).md)
- [init(tcc_modify:)](endpointsecurity/es_events_t/init(tcc_modify:).md)
- [init(trace:)](endpointsecurity/es_events_t/init(trace:).md)
- [init(truncate:)](endpointsecurity/es_events_t/init(truncate:).md)
- [init(uipc_bind:)](endpointsecurity/es_events_t/init(uipc_bind:).md)
- [init(uipc_connect:)](endpointsecurity/es_events_t/init(uipc_connect:).md)
- [init(unlink:)](endpointsecurity/es_events_t/init(unlink:).md)
- [init(unmount:)](endpointsecurity/es_events_t/init(unmount:).md)
- [init(utimes:)](endpointsecurity/es_events_t/init(utimes:).md)
- [init(write:)](endpointsecurity/es_events_t/init(write:).md)
- [init(xp_malware_detected:)](endpointsecurity/es_events_t/init(xp_malware_detected:).md)
- [init(xp_malware_remediated:)](endpointsecurity/es_events_t/init(xp_malware_remediated:).md)
- [init(xpc_connect:)](endpointsecurity/es_events_t/init(xpc_connect:).md)

### Instance Properties

- [authentication](endpointsecurity/es_events_t/authentication.md)
- [authorization_judgement](endpointsecurity/es_events_t/authorization_judgement.md)
- [authorization_petition](endpointsecurity/es_events_t/authorization_petition.md)
- [btm_launch_item_add](endpointsecurity/es_events_t/btm_launch_item_add.md)
- [btm_launch_item_remove](endpointsecurity/es_events_t/btm_launch_item_remove.md)
- [gatekeeper_user_override](endpointsecurity/es_events_t/gatekeeper_user_override.md)
- [login_login](endpointsecurity/es_events_t/login_login.md)
- [login_logout](endpointsecurity/es_events_t/login_logout.md)
- [lw_session_lock](endpointsecurity/es_events_t/lw_session_lock.md)
- [lw_session_login](endpointsecurity/es_events_t/lw_session_login.md)
- [lw_session_logout](endpointsecurity/es_events_t/lw_session_logout.md)
- [lw_session_unlock](endpointsecurity/es_events_t/lw_session_unlock.md)
- [od_attribute_set](endpointsecurity/es_events_t/od_attribute_set.md)
- [od_attribute_value_add](endpointsecurity/es_events_t/od_attribute_value_add.md)
- [od_attribute_value_remove](endpointsecurity/es_events_t/od_attribute_value_remove.md)
- [od_create_group](endpointsecurity/es_events_t/od_create_group.md)
- [od_create_user](endpointsecurity/es_events_t/od_create_user.md)
- [od_delete_group](endpointsecurity/es_events_t/od_delete_group.md)
- [od_delete_user](endpointsecurity/es_events_t/od_delete_user.md)
- [od_disable_user](endpointsecurity/es_events_t/od_disable_user.md)
- [od_enable_user](endpointsecurity/es_events_t/od_enable_user.md)
- [od_group_add](endpointsecurity/es_events_t/od_group_add.md)
- [od_group_remove](endpointsecurity/es_events_t/od_group_remove.md)
- [od_group_set](endpointsecurity/es_events_t/od_group_set.md)
- [od_modify_password](endpointsecurity/es_events_t/od_modify_password.md)
- [openssh_login](endpointsecurity/es_events_t/openssh_login.md)
- [openssh_logout](endpointsecurity/es_events_t/openssh_logout.md)
- [profile_add](endpointsecurity/es_events_t/profile_add.md)
- [profile_remove](endpointsecurity/es_events_t/profile_remove.md)
- [screensharing_attach](endpointsecurity/es_events_t/screensharing_attach.md)
- [screensharing_detach](endpointsecurity/es_events_t/screensharing_detach.md)
- [su](endpointsecurity/es_events_t/su.md)
- [sudo](endpointsecurity/es_events_t/sudo.md)
- [tcc_modify](endpointsecurity/es_events_t/tcc_modify.md)
- [xp_malware_detected](endpointsecurity/es_events_t/xp_malware_detected.md)
- [xp_malware_remediated](endpointsecurity/es_events_t/xp_malware_remediated.md)
- [xpc_connect](endpointsecurity/es_events_t/xpc_connect.md)

## Relationships

### Conforms To

- [Sendable](swift/sendable.md)

## See Also

### Identifying the Matched Event

- [event](endpointsecurity/es_message_t/event.md)
- [event_type](endpointsecurity/es_message_t/event_type.md)
- [es_event_type_t](endpointsecurity/es_event_type_t.md)