watchdogd

executablemacOS363.7 KBx86_64, arm64

Security monitoring daemon — tracks process, file, and network activity for endpoint protection

Monitors process launches, file operations, and network connections using the Endpoint Security framework. Collects telemetry on system activity and submits analytics to Apple. Communicates with other system components through 12 XPC services and accesses hardware via IOKit user clients. Stores monitoring data in private storage areas and reports findings to remote endpoints.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 363.7 KB
UUID: 02ACB1A0-E6A5-3236-81B6-D3F52391CEA5
Analyzed: 2026-04-07T06:28:52Z
CDHash: 8cb0d423c7c90f2a3e7f5fc2500198999ccbb6314c16c5461a79d6b3cdd40591

Capabilities

StoragePrivate storage area access

com.apple.private.security.storage.spindump [object Object]

HardwareException: access additional IOKit user clients

com.apple.security.exception.iokit-user-client-class

EndpointSecurityExternalClient

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityEndpoint Security (process/file/network monitoring)

/usr/lib/libEndpointSecurity.dylib

Frameworks16

IOKit ServiceManagement AppServerSupport Foundation CoreAnalytics(weak)DiagnosticRequest(weak)OSAnalytics CoreDiagnostics APFS CoreFoundation SampleAnalysis CrashReporterSupport libtailspin.dylib(weak)libEndpointSecurity.dylib(weak)libobjc.A.dylib libSystem.B.dylib

Entitlements22

com.apple.developer.endpoint-security.clienttrue

com.apple.diagnosticpipeline.requesttrue

com.apple.frontboard.launchapplicationstrue

com.apple.osanalytics.otatasking-service-accesstrue

com.apple.private.apfs.key_migrationtrue

com.apple.private.endpoint-security.clienttrue

com.apple.private.endpoint-security.default-mutertrue

com.apple.private.endpoint-security.embeddedclienttrue

com.apple.private.iowatchdog.user-accesstrue

com.apple.private.power.notificationstrue

com.apple.private.security.storage.spindumptrue

com.apple.private.security.waitquiet-panicstrue

com.apple.private.stackshottrue

com.apple.private.tcc.allow

kTCCServiceEndpointSecurityClient kTCCServiceSystemPolicyAllFiles

com.apple.private.unblocktrue

com.apple.private.xpc.launchd.job-manager com.apple.watchdogd

com.apple.security.exception.iokit-user-client-class

EndpointSecurityExternalClient

com.apple.security.iokit-user-client-class

AppleAPFSUserClient IOWatchdogUserClient RootDomainUserClient

com.apple.security.system-groups

systemgroup.com.apple.osanalytics

com.apple.springboard.remote-alerttrue

com.apple.tailspin.dump-outputtrue

com.apple.usernotifications.usernotificationservicetrue

Interesting Strings

Bundle IDs(96)

com.apple.security.system-groups0#!systemgroup.com.apple.osanalytics0'"com.apple.springboard.remote-alert $com.apple.diagnosticpipeline.request $com.apple.private.apfs.key_migration

File Paths(14)

/Library/Logs/DiagnosticReports /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement

telemetry(22)

!systemgroup.com.apple.osanalytics0'/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /System/Library/PrivateFrameworks/CoreDiagnostics.framework/Versions/A/CoreDiagnostics /System/Library/PrivateFrameworks/OSAnalytics.framework/Versions/A/OSAnalytics /com.apple.osanalytics.otatasking-service-access

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">com.apple.commcenter.oswatchdog https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Hostnameyyyy-MM-dd.HH.mm.ss

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

1

Hardware

2

IPC

0

Analytics

1

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

22

File Paths

14

Bundle IDs

96

IOKit Constants

0

Library Functions

1

Structural HashesSHA-256

Codef88ebe7092adb4749654df70bd271c8f395b73aa6b1f1a24fed526b0c238a2a4

Imports92273a082d23886eadca23682e3219a1bdb4ad6229c8b2fe961019a0e8eb7d27

Frameworksb3bd566fce7f046b4337af3dc751b311a856e87f077ae0a11ec68b4c3824160f

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementsbb35393a1a1f1ed42a4275b425707933d26ca1517e16f188a8d850cc0ef05cbb

Symbols92273a082d23886eadca23682e3219a1bdb4ad6229c8b2fe961019a0e8eb7d27

Static Libraries0 / 215 functions identified

Function Matches(1)

ERR_reason_error_stringopenssl 3.6High

Functions(215)

0x1000010c0sub_1000010c0

0x100001248sub_100001248

0x100001318sub_100001318

0x100001360sub_100001360

0x1000014a4sub_1000014a4

0x1000014f4sub_1000014f4

0x100001690sub_100001690

0x1000016d8sub_1000016d8

0x100001714sub_100001714

0x1000017f4sub_1000017f4

0x10000183csub_10000183c

0x100001918sub_100001918

0x100001960sub_100001960

0x1000019bcsub_1000019bc

0x100001a3csub_100001a3c

0x100001b30sub_100001b30

0x100001b3csub_100001b3c

0x100002204sub_100002204

0x100002444sub_100002444

0x100002574sub_100002574

Imports293 symbols from 14 dylibs

libSystem.B.dylib184 CoreFoundation31 IOKit24 libobjc.A.dylib21 Foundation12

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

applessdstatistics

ReportMemoryException

IOMFB_bics_daemon

InternetSharing