---
title: Event Types
framework: endpointsecurity
role: collectionGroup
role_heading: API Collection
path: endpointsecurity/event-types
---

# Event Types

Types used by messages to deliver details specific to different kinds of Endpoint Security events.

## Overview

Overview The types in this section contain details of each event that an Endpoint Security message can contain. While the es_message_t type itself is generic, the members of its event union contain specific event types. For example, when the message’s event_type is ES_EVENT_TYPE_NOTIFY_FORK, you access the event’s fork member, whose type is es_event_fork_t. This type has properties specific to process-forking events, such as the child process that resulted from the fork operation.

## Topics

### File-System Event Types

- [es_file_t](endpointsecurity/es_file_t.md)
- [es_event_access_t](endpointsecurity/es_event_access_t.md)
- [es_event_clone_t](endpointsecurity/es_event_clone_t.md)
- [es_event_copyfile_t](endpointsecurity/es_event_copyfile_t.md)
- [es_event_create_t](endpointsecurity/es_event_create_t.md)
- [es_event_dup_t](endpointsecurity/es_event_dup_t.md)
- [es_event_fcntl_t](endpointsecurity/es_event_fcntl_t.md)
- [es_event_open_t](endpointsecurity/es_event_open_t.md)
- [es_event_close_t](endpointsecurity/es_event_close_t.md)
- [es_event_rename_t](endpointsecurity/es_event_rename_t.md)
- [es_event_truncate_t](endpointsecurity/es_event_truncate_t.md)
- [es_event_exchangedata_t](endpointsecurity/es_event_exchangedata_t.md)
- [es_event_write_t](endpointsecurity/es_event_write_t.md)
- [es_event_lookup_t](endpointsecurity/es_event_lookup_t.md)
- [es_event_searchfs_t](endpointsecurity/es_event_searchfs_t.md)

### File Metadata Event Types

- [es_event_deleteextattr_t](endpointsecurity/es_event_deleteextattr_t.md)
- [es_event_fsgetpath_t](endpointsecurity/es_event_fsgetpath_t.md)
- [es_event_getattrlist_t](endpointsecurity/es_event_getattrlist_t.md)
- [es_event_getextattr_t](endpointsecurity/es_event_getextattr_t.md)
- [es_event_listextattr_t](endpointsecurity/es_event_listextattr_t.md)
- [es_event_readdir_t](endpointsecurity/es_event_readdir_t.md)
- [es_event_setacl_t](endpointsecurity/es_event_setacl_t.md)
- [es_event_setattrlist_t](endpointsecurity/es_event_setattrlist_t.md)
- [es_event_setextattr_t](endpointsecurity/es_event_setextattr_t.md)
- [es_event_setflags_t](endpointsecurity/es_event_setflags_t.md)
- [es_event_setmode_t](endpointsecurity/es_event_setmode_t.md)
- [es_event_setowner_t](endpointsecurity/es_event_setowner_t.md)
- [es_event_stat_t](endpointsecurity/es_event_stat_t.md)
- [es_event_utimes_t](endpointsecurity/es_event_utimes_t.md)

### File Provider Event Types

- [es_event_file_provider_materialize_t](endpointsecurity/es_event_file_provider_materialize_t.md)
- [es_event_file_provider_update_t](endpointsecurity/es_event_file_provider_update_t.md)

### Link Event Types

- [es_event_link_t](endpointsecurity/es_event_link_t.md)
- [es_event_readlink_t](endpointsecurity/es_event_readlink_t.md)
- [es_event_unlink_t](endpointsecurity/es_event_unlink_t.md)

### File System Mounting Event Types

- [es_event_mount_t](endpointsecurity/es_event_mount_t.md)
- [es_event_unmount_t](endpointsecurity/es_event_unmount_t.md)
- [es_event_remount_t](endpointsecurity/es_event_remount_t.md)

### Memory Mapping Event Types

- [es_event_mmap_t](endpointsecurity/es_event_mmap_t.md)
- [es_event_mprotect_t](endpointsecurity/es_event_mprotect_t.md)

### Process Event Types

- [es_event_chdir_t](endpointsecurity/es_event_chdir_t.md)
- [es_event_chroot_t](endpointsecurity/es_event_chroot_t.md)
- [es_event_exec_t](endpointsecurity/es_event_exec_t.md)
- [es_event_fork_t](endpointsecurity/es_event_fork_t.md)
- [es_event_proc_check_t](endpointsecurity/es_event_proc_check_t.md)
- [es_event_signal_t](endpointsecurity/es_event_signal_t.md)
- [es_event_exit_t](endpointsecurity/es_event_exit_t.md)

### Process Event Helper Functions

- [es_exec_arg(_:_:)](endpointsecurity/es_exec_arg(_:_:).md)
- [es_exec_arg_count(_:)](endpointsecurity/es_exec_arg_count(_:).md)
- [es_exec_env(_:_:)](endpointsecurity/es_exec_env(_:_:).md)
- [es_exec_env_count(_:)](endpointsecurity/es_exec_env_count(_:).md)
- [es_exec_fd(_:_:)](endpointsecurity/es_exec_fd(_:_:).md)
- [es_exec_fd_count(_:)](endpointsecurity/es_exec_fd_count(_:).md)
- [es_fd_t](endpointsecurity/es_fd_t.md)

### Interprocess Events

- [es_event_proc_suspend_resume_t](endpointsecurity/es_event_proc_suspend_resume_t.md)
- [es_event_trace_t](endpointsecurity/es_event_trace_t.md)
- [es_event_remote_thread_create_t](endpointsecurity/es_event_remote_thread_create_t.md)

### Task Port Event Types

- [es_event_get_task_t](endpointsecurity/es_event_get_task_t.md)
- [es_event_get_task_read_t](endpointsecurity/es_event_get_task_read_t.md)
- [es_event_get_task_inspect_t](endpointsecurity/es_event_get_task_inspect_t.md)
- [es_event_get_task_name_t](endpointsecurity/es_event_get_task_name_t.md)

### User and Group ID Types

- [es_event_setuid_t](endpointsecurity/es_event_setuid_t.md)
- [es_event_setgid_t](endpointsecurity/es_event_setgid_t.md)
- [es_event_seteuid_t](endpointsecurity/es_event_seteuid_t.md)
- [es_event_setegid_t](endpointsecurity/es_event_setegid_t.md)
- [es_event_setreuid_t](endpointsecurity/es_event_setreuid_t.md)
- [es_event_setregid_t](endpointsecurity/es_event_setregid_t.md)

### Code Signing Event Types

- [es_event_cs_invalidated_t](endpointsecurity/es_event_cs_invalidated_t.md)

### Socket Event Types

- [es_event_uipc_bind_t](endpointsecurity/es_event_uipc_bind_t.md)
- [es_event_uipc_connect_t](endpointsecurity/es_event_uipc_connect_t.md)

### Clock Event Types

- [es_event_settime_t](endpointsecurity/es_event_settime_t.md)

### Kernel Event Types

- [es_event_iokit_open_t](endpointsecurity/es_event_iokit_open_t.md)
- [es_event_kextload_t](endpointsecurity/es_event_kextload_t.md)
- [es_event_kextunload_t](endpointsecurity/es_event_kextunload_t.md)

### Pseudoterminal Event Types

- [es_event_pty_close_t](endpointsecurity/es_event_pty_close_t.md)
- [es_event_pty_grant_t](endpointsecurity/es_event_pty_grant_t.md)

## See Also

### Event Monitoring

- [Client](endpointsecurity/client.md)
- [Message](endpointsecurity/message.md)