---
title: action
framework: endpointsecurity
role: symbol
role_heading: Instance Property
path: endpointsecurity/es_message_t/action
---

# action

The action monitored by Endpoint Security.

## Declaration

```swift
var action: es_message_t.__Unnamed_union_action
```

## Discussion

Discussion The action is a union of an es_event_id_t named auth and an es_result_t named notify. Use the action_type field to determine which kind of action this message represents.

## See Also

### Inspecting Message Properties

- [action_type](endpointsecurity/es_message_t/action_type.md)
- [es_action_type_t](endpointsecurity/es_action_type_t.md)
- [es_event_id_t](endpointsecurity/es_event_id_t.md)
- [es_result_t](endpointsecurity/es_result_t.md)
- [version](endpointsecurity/es_message_t/version.md)