endpoint_sec_sys

Function es_subscribe

Source 
pub unsafe extern "C" fn es_subscribe(
    client: *mut es_client_t,
    events: *const es_event_type_t,
    event_count: u32,
) -> es_return_t
Available on macOS only.
Expand description

Subscribe to some set of events

  • client: The client that will be subscribing
  • events: Array of es_event_type_t to subscribe to
  • event_count: Count of es_event_type_t in events

Subscribing to new event types does not remove previous subscriptions.

Subscribing to events is not optional for clients that have opted into early boot mode (see NSEndpointSecurityEarlyBoot in EndpointSecurity(7)). Early boot clients that fail to subscribe to at least one event type will cause early boot to time out, resulting in a bad user experience and risking watchdog timeout panics.