Totally that's why Apple made endpoint security for security vendors. You can even pipe the events from the kernel with "sudo eslogger exec | jq" on the new mac

Totally that's why Apple made endpoint security for security vendors. You can even pipe the events from the kernel with "sudo eslogger exec | jq" on the new macOS https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity