Follow the events
Filter captured events by type, process, path, and decision. Aggregate repeated activity when a sequence becomes noisy.
← Project directory
Security research / macOS
Endpoint Security Inspector
See what happens beneath the app.
A native workspace for understanding how applications interact with macOS. Follow process and file events, inspect their details, and bring an investigation back to the rule that matters.
Available on request
Endpoint SecurityEvent inspectorProcess context
01 / Why it exists
Make system behaviour visible.
When an operation crosses executables, helpers, and files, the useful answer is often in the relationship between events. Endpoint Security Inspector combines a journal, process information, event filters, and explicit policies in one place.
Inspect the context
Read complete event fields, process identities, parent relationships, arguments, and destination paths in the inspector.
Explore explicit rules
Configure monitored and blocked targets and event mutes. Keep policy decisions alongside the activity they explain.
02 / A closer look
A considered workspace.
See the interface in detail.
Open any image to explore it.
03 / In practice
Make it part
of your day.
- 01
Choose a scope
Configure the processes, files, and event types for your investigation.
- 02
Inspect the journal
Filter or aggregate events and select a record for full context.
- 03
Keep the result
Use event details and exports to support your diagnosis.
Local records
Configuration and event history are kept locally. Records can include paths, user and process identities, arguments, and environment data.
System integration
Capture uses a privileged Endpoint Security service. macOS requires the relevant entitlements and system permissions.
Exports
Diagnostic exports may contain sensitive system metadata. Review them before sharing. Capture does not make private fields public.
05 / Get started
Let’s put it to work.
This independent application is available on request. Tell me what you want to use it for and which device and OS version you have.
Request access ↗A question about the app?
A good place to start.
Setup, everyday use, and a direct way to get help.
Help & support ↗Contact the developer ↗