Apple's own endpoint sensor, without an agent

Thu, 05 Nov 2026 00:00:00 +0000

I went looking for the best way to monitor the security of my personal macOS environment, and it turned into an in-depth investigation of how much eslogger can tell about a Mac. The environment has three Macs in it, and I started with one. The one this series begins with is a MacBook Air (15-inch, M3, 2024), which goes everywhere with me. It carries my work: the code I am working on, my research, the security events I review, architecture work and some limited penetration testing, along with confidential findings that could do harm in the wrong hands. It carries the rest of my life too, and some of other people’s. On it I talk to prospects and customers, message everyone I know, the people closest to me included, keep a journal, read about things that touch on how I am doing, and edit documents I would not want anyone else to open. (While working on this piece I was arranging an appointment with my dentist on it.) That puts almost everything personal on one machine. That is where my doubts about installing more software on it came from. The other two are the next steps of the investigation. The second is a Mac Studio M5 Ultra that I am setting up as a local AI workstation, where monitoring is closer to watching a hypervisor that runs large local models. The third is an Intel MacBook Pro (16-inch, 2019) with an i9 and 32 GB of memory, a useful contrast, because an Intel Mac still loads third-party kernel extensions without lowering its boot security. Both will join the investigation later in the series.

macos on HBCC

Apple's own endpoint sensor, without an agent