EPSpy

Records supported EndpointSecurity.framework events into a JSON file.

Installing

Release binaries are signed with adhoc certificate and have the com.apple.developer.endpoint-security.client entitlement, so it is required that SIP and/or AMFI be disabled to run. It is recommended to run this tool in a VM.

To install EPSpy, download the latest release from the releases page. Extract to /Applications. Run the following command:

xattr -r -d com.apple.quarantine /Applications/EPSpy.app

To uninstall, delete EPSpy.app from /Applications.

Running

On first run record, the system will ask you to enable an extension. You can enable it right away in the notification:

or in Settings, under Login Items & Extensions:

Troubleshooting

• The following error indicates that the login item has not been enabled.

• If you click on the record button and nothing happens, including no error, it means you are trying to record on a machine that is SIP enabled. Disable SIP and try again.