managedeventsd

Endpoint Security monitor — tracks process, file, and network activity

Monitors system activity through the Endpoint Security framework, observing process execution, file operations, and network connections. Maintains private storage for collected data and exposes three XPC services for querying monitoring state and activity logs. Communicates with eight network endpoints, likely for telemetry or policy synchronization. Instruments 20 bundle identifiers across the system to classify activity by application.AI