es_message_t
A message from the Endpoint Security subsystem that describes a security event.
Declaration
struct es_message_tOverview
A message contains an event monitored by Endpoint Security and an action to perform. The event is a union of types specific to each kind of event. For example, a file-renaming event provides the source and destination paths as the union member rename. Similarly, a process fork event provides the process identifier of the new child process as the union member fork. Inspect the event_type to determine which member of the union to access.
A message can be an authorization request, or a notification of an event that has already taken place, as indicated by the action_type field. For authorization messages, your client handler calls es_respond_auth_result(_:_:_:_:) or es_respond_flags_result(_:_:_:_:) to authorize, deny, or pass behavior flags back to Endpoint Security.