Brandon7CC/mac-monitor: Advanced macOS Security Event Monitoring

Brandon7CC/mac-monitor: Advanced macOS Security Event Monitoring

MacOS lacks a native equivalent to Windows ProcMon for deep system event inspection. Security researchers, malware analysts, and system troubleshooters on Apple Silicon and Intel machines have historically pieced together multiple tools or relied on command-line utilities with steep learning curves. Brandon7CC/mac-monitor fills this gap as a purpose-built graphical tool that leverages Apple's Endpoint Security framework to record, enrich, and display system events for analysis.

This article examines how mac-monitor works, what it offers for macOS security research, and how to get it running on Ventura or later.

What is Brandon7CC/mac-monitor?

Brandon7CC/mac-monitor is an open-source, standalone system monitoring application for macOS 13.1+ built primarily in Swift. With 1,359 GitHub stars and 68 forks as of its last commit on June 25, 2026, it occupies a specialized niche: graphical endpoint security telemetry for macOS that does not require enterprise EDR infrastructure.

The project is maintained by Brandon Dalton (Brandon7CC) and released under the BSD 3-Clause License. It is not a commercial product nor a cloud-connected service. Instead, it functions as a local-only analysis workstation, collecting events through a System Extension that interfaces with Apple's Endpoint Security (ES) API.

The tool's relevance stems from Apple's progressive hardening of macOS. With each release, legitimate security research becomes more constrained by System Integrity Protection, notarization requirements, and restricted API access. Mac-monitor navigates these constraints by operating as an approved System Extension with Full Disk Access, enabling it to subscribe to ES event streams that ordinary applications cannot access. This architectural choice makes it particularly valuable for researchers who need visibility into process execution, interprocess communication, file system activity, and memory events without building custom kernel extensions.

The project was presented at OBTS v8.0 (2025), with slides and a YouTube recording available for technical deep-dives.

Key Features

High-fidelity Endpoint Security event collection. Mac-monitor subscribes to ES events including process execution (ES_EVENT_TYPE_NOTIFY_EXEC), forks, interprocess communication, memory operations, XPC messaging, and file system events. Events arrive enriched with contextual metadata: code signing certificate chains, File Quarantine attributes, environment variables, and correlated related events.

Dynamic runtime subscription management. Rather than fixing event subscriptions at launch, users can modify which ES events to capture on-the-fly. This reduces noise during active triage sessions without requiring restarts or configuration file edits.

Path muting at the ES API level. The tool exposes Apple's advanced path muting capabilities: es_mute_path and es_mute_path_events with prefix, literal, target-prefix, and target-literal matching modes. This operates below the application layer, filtering events before they reach the UI or storage stack.

Event correlation and process grouping. Related events are linked at the process level, enabling analysts to trace initiating and target process chains. Process subtree visualization shows lineage from fork through execution, with interactive navigation between correlated events.

Artifact filtering with lossless and lossy modes. Users can hide events from view based on event type, initiating path, or target path without deleting underlying data. A separate "drop platform binaries" option provides lossy filtering for high-noise scenarios.

Telemetry export. Full or partial traces export as pretty-printed JSON or JSONL via menu bar options or keyboard shortcuts.

Asynchronous Core Data storage. Events persist as in-memory entities with parent-child relationships, enabling large trace volumes without hard event limits. Insertion latency increases with very large datasets, but the architecture avoids the memory pressure of unbounded array storage.

Resource-conscious System Extension. The security extension (com.swiftlydetecting.agent.securityextension) does not process events when no trace is active, minimizing idle CPU and battery impact.

Use Cases

Malware triage and reverse engineering. When analyzing suspicious macOS binaries, researchers need to observe behavioral indicators: unexpected process spawning, persistence mechanisms via LaunchAgents/Daemons, file system modifications, and network-adjacent XPC communications. Mac-monitor's event correlation and process grouping reveal these patterns without requiring a full sandbox environment.

System troubleshooting and performance investigation. Developers investigating errant system behavior—runaway processes, unexpected file access, or permission escalations—can use dynamic subscription filtering to isolate relevant event streams. The distribution chart quickly surfaces unexpectedly noisy event types.

Security tool validation. Teams building or evaluating macOS security products can use mac-monitor as a ground-truth reference. Its direct ES API access provides unfiltered telemetry against which EDR agents or monitoring tools can be validated for completeness and accuracy.

macOS security training. The graphical interface and event fact windows lower the barrier for analysts new to macOS internals. Curated metadata presentation helps learners connect abstract ES event types to concrete system behaviors.

Incident response on Apple Silicon. With native Apple Silicon support recommended (Intel compatible), incident responders can deploy mac-monitor on modern hardware without Rosetta translation concerns or x86-specific tooling dependencies.

Installation & Setup

Requirements

• Processor: Apple Silicon recommended; Intel supported
• RAM: 4GB minimum recommended
• macOS: 13.1 (Ventura) or later

Installation Methods

Homebrew (recommended):

brew install --cask mac-monitor

Installer package from GitHub releases:

Download the latest .pkg from https://github.com/Brandon7CC/mac-monitor/releases

Post-Installation Configuration

1. Open Mac Monitor.app from /Applications/
2. When prompted, click "Open System Settings" to allow the System Extension
3. System Settings automatically navigates to Full Disk Access — enable the toggle for Mac Monitor Security Extension
   • Note: Full Disk Access is a hard requirement of Apple's Endpoint Security framework, not an arbitrary choice by the developer.
4. Click the Start button in the application; you will be prompted to relaunch
5. After relaunch, event collection begins

Install Footprint

• Main application: /Applications/Mac Monitor.app (signing ID: com.swiftlydetecting.agent)
• System Extension: /Library/SystemExtensions/.../com.swiftlydetecting.agent.securityextension.systemextension (signing ID: com.swiftlydetecting.agent.securityextension.systemextension)

Uninstallation

Delete Mac Monitor.app from Finder (not the Dock) and authenticate to remove the System Extension. Alternatively, remove only the Security Extension via the app's menu bar or settings. Version 1.0.3+ includes an uninstall script at:

/Applications/Mac Monitor.app/Contents/SharedSupport/uninstall.sh

Real Code Examples

The mac-monitor repository does not contain traditional API code samples or integration scripts; it is a complete application rather than a library. However, the README documents specific ES API constants and configuration patterns that reveal how the tool operates. Below are the substantive technical references present in the documentation.

ES Event Types Subscribed

The tool subscribes to and models these Endpoint Security event types, among others:

ES_EVENT_TYPE_NOTIFY_EXEC    // Process execution
ES_EVENT_TYPE_NOTIFY_FORK    // Process fork

These constants from <EndpointSecurity/EndpointSecurity.h> represent core process lifecycle events. Mac-monitor's process grouping feature specifically organizes telemetry around NOTIFY_EXEC and NOTIFY_FORK events to reconstruct process trees.

Path Muting API Coverage

The README documents the specific ES muting API surface implemented:

es_mute_path          // Mute paths from event delivery
es_mute_path_events   // Mute specific events for paths

ES_MUTE_PATH_TYPE_PREFIX         // Match path prefixes
ES_MUTE_PATH_TYPE_LITERAL        // Exact path match
ES_MUTE_PATH_TYPE_TARGET_PREFIX  // Match target path prefixes
ES_MUTE_PATH_TYPE_TARGET_LITERAL // Exact target path match

This implementation covers the majority of Apple's path muting API as of the documented version. The README explicitly notes that inversion muting is not currently supported, with a feature request for per-event rather than per-client inversion granularity.

Event Export Formats

The application supports two JSON export formats accessible via menu bar:

Export Telemetry → Pretty JSON   // Human-readable formatted output
Export Telemetry → JSONL         // One JSON object per line

Both formats support full-trace or partial-trace export, with keyboard shortcuts available. These exports enable integration with external analysis pipelines, SIEM ingestion, or custom tooling.

The current documentation does not provide additional code-level integration examples. Users seeking programmatic access to ES events directly may need to build separate tools using the EndpointSecurity framework, with mac-monitor serving as a reference implementation for event interpretation and correlation logic.

Advanced Usage & Best Practices

Start broad, then filter dynamically. Begin traces with wider event subscriptions, then use runtime subscription modification and path muting to eliminate noise. This approach ensures you do not miss relevant events during initial collection.

Leverage event facts for pivoting. Right-click any table row to access the event facts window. Use this for rapid pivoting between correlated events rather than scrolling through chronological streams.

Monitor the distribution chart. The SwiftUI-based event distribution chart auto-hides but can be recalled via the "Mini-chart" toolbar button. Use it to identify unexpectedly noisy event types that may indicate misbehaving software or overly broad subscriptions.

Export before filtering aggressively. The lossless artifact filtering preserves underlying data; however, if you plan to share traces or perform retrospective analysis, export before applying lossy filters like "drop platform binaries."

Consider memory implications for long traces. While the Core Data stack supports large event volumes, insertion latency increases with size. For extended monitoring sessions, periodic export and reset may improve responsiveness.

Comparison with Alternatives

Mac-monitor occupies a middle ground: more accessible than raw ES programming, more analyst-focused than lightweight command-line tools, and entirely local compared to commercial EDR. It does not replace enterprise security infrastructure but serves researchers and practitioners who need deep visibility without organizational tooling dependencies.

FAQ

Does mac-monitor work on Intel Macs? Yes, though Apple Silicon is recommended for optimal performance.

Why does it need Full Disk Access? Apple's Endpoint Security framework requires this entitlement; the tool cannot function without it.

Is telemetry sent to any cloud service? No. All event collection and storage is local to the machine.

What license applies? BSD 3-Clause "New" or "Revised" License.

Can I use this for commercial security research? The BSD license permits commercial use; verify compliance with your organization's policies.

How do I report bugs or request features? Use the GitHub Issues tracker at the repository linked below.

Does it support macOS versions before Ventura (13.1)? No. The Endpoint Security APIs and System Extension requirements necessitate 13.1 or later.

Conclusion

Brandon7CC/mac-monitor delivers focused, native macOS endpoint visibility for security researchers, malware analysts, and system troubleshooters who need more than command-line utilities but less complexity than enterprise EDR platforms. Its direct use of Apple's Endpoint Security API, combined with thoughtful UI features like event correlation, dynamic filtering, and process tree visualization, makes it a practical addition to macOS security toolkits.

The tool suits individual researchers, small security teams, and educational contexts particularly well. It is not a replacement for managed detection and response infrastructure, nor does it attempt to be. Instead, it fills a specific gap: accessible, high-fidelity macOS system event analysis with minimal setup friction.

Download the latest release, install via Homebrew, or review the source at https://github.com/Brandon7CC/mac-monitor. For deeper technical background, the OBTS v8.0 presentation materials provide additional architectural detail.

For related macOS security tooling, see [INTERNAL_LINK: macOS malware analysis tools] or [INTERNAL_LINK: Endpoint Security API programming guide].