Window app

EndpointScope

Every process. Every file. Every login.
Straight from Endpoint Security.

Download Learn more ›

Version 1.0 · macOS 14 Sonoma or later · 3.7 MB zip

EndpointScopesample-incident.json⌕ Search eventsExport ▾
Overview
Events2,014
Processes
Findings23
File Activity
Access & Privilege
Live Monitor
Background Monitor
Capture Files1
ES Setup
Reference
Events
2,014
Execs
318
Untrusted code
9
Findings
23
Activity by category Process File Security
SeverityFindingATT&CKTime
CriticalFull Disk Access granted to unsigned binary via TCC.dbT154816:42:10
CriticalES client terminated: endpoint agent killed by root shellT1562.00116:44:31
HighLaunchAgent created by ad-hoc signed process in /tmpT1543.00116:41:02
HighKeychain and browser credential stores read by osascriptT155516:40:47
HighHidden admin account “_support” createdT1136.00116:43:15
Overview of the bundled sample incident: an SSH brute force leading to a credential-stealing implant.

AuditScope’s sibling, for the modern stack.

EndpointScope reads the JSON from Apple’s built-in eslogger, from capture files or live, and turns Endpoint Security events into views you can investigate.

Overview

Event, exec and untrusted-code counts, a timeline stacked by category, TCC changes, background items and developer teams.

Events

Search, filter and pivot. The inspector shows full code-signing identity for the acting, target and instigator processes.

Processes

A tree built from audit tokens, with fork-then-exec stubs collapsed and real names for processes already running.

Findings

About 55 rules mapped to MITRE ATT&CK, from SSH brute force to TCC grants, injection and XProtect detections.

Live Monitor

Streams eslogger with your own event selection and runs detections every second.

Background alerts

Keeps capturing from the menu bar and notifies you about High and Critical findings.

Capture your way.

Capture from Terminal and open the file, or capture live from inside the app. ES Setup checks your Mac and builds the command for you.

ES Setup

eslogger
Available
Full Disk Access
Required for the responsible process
Event presetBuilds the eslogger command line.
Investigation

Live Monitor

Asks for an administrator password
Start Capture
Add the buffer to the analysis views
Analyse Capture

Export

Filtered events
eslogger JSON Lines, CSV or normalised JSON
Findings
Markdown report

Live capture relaunches EndpointScope’s own binary as root to run /usr/bin/eslogger, and stops when you stop. Nothing privileged is installed. Re-add the app to Full Disk Access after each rebuild.

Tech specs

Requirements
macOS 14 Sonoma or later
Parser
Reads JSON Lines, pretty-printed and array output, covering about 100 event types. The roughly 2,000-event sample decodes in about 0.15 s.
Command line
--analyse capture.json prints a summary and findings without the window
Version
1.0 · universal · ad-hoc signed
Download
EndpointScope.zip · 3.7 MB

Get EndpointScope.

Universal app for macOS 14 and later. Open it with the sample incident to explore before you capture.

Download · 3.7 MB