---
title: es_message_t
framework: endpointsecurity
role: symbol
role_heading: Structure
path: endpointsecurity/es_message_t
---

# es_message_t

A message from the Endpoint Security subsystem that describes a security event.

## Declaration

```swift
struct es_message_t
```

## Overview

Overview A message contains an event monitored by Endpoint Security and an action to perform. The event is a union of types specific to each kind of event. For example, a file-renaming event provides the source and destination paths as the union member rename. Similarly, a process fork event provides the process identifier of the new child process as the union member fork. Inspect the event_type to determine which member of the union to access. A message can be an authorization request, or a notification of an event that has already taken place, as indicated by the action_type field. For authorization messages, your client handler calls es_respond_auth_result(_:_:_:_:) or es_respond_flags_result(_:_:_:_:) to authorize, deny, or pass behavior flags back to Endpoint Security.

## Topics

### Inspecting Message Properties

- [action](endpointsecurity/es_message_t/action.md)
- [action_type](endpointsecurity/es_message_t/action_type.md)
- [es_action_type_t](endpointsecurity/es_action_type_t.md)
- [es_event_id_t](endpointsecurity/es_event_id_t.md)
- [es_result_t](endpointsecurity/es_result_t.md)
- [version](endpointsecurity/es_message_t/version.md)

### Identifying the Matched Event

- [event](endpointsecurity/es_message_t/event.md)
- [es_events_t](endpointsecurity/es_events_t.md)
- [event_type](endpointsecurity/es_message_t/event_type.md)
- [es_event_type_t](endpointsecurity/es_event_type_t.md)

### Inspecting Timing Properties

- [time](endpointsecurity/es_message_t/time.md)
- [mach_time](endpointsecurity/es_message_t/mach_time.md)
- [deadline](endpointsecurity/es_message_t/deadline.md)
- [seq_num](endpointsecurity/es_message_t/seq_num.md)
- [global_seq_num](endpointsecurity/es_message_t/global_seq_num.md)

### Identifying the Source Process

- [process](endpointsecurity/es_message_t/process.md)
- [es_process_t](endpointsecurity/es_process_t.md)

### Inspecting Thread Properties

- [thread](endpointsecurity/es_message_t/thread.md)
- [es_thread_t](endpointsecurity/es_thread_t.md)