Brandon7CC/mac-monitor

Health v2 · maintenance only

Adoption not part of the score

1379 stars · 65 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Mac Monitor is a stand-alone macOS application that uses Apple's Endpoint Security and System Extension APIs to collect and enrich system events such as process, file, XPC, and interprocess activity. It displays this telemetry graphically to support macOS security research, malware triage, and system troubleshooting.

Use cases

• monitor process and file events on macOS like ProcMon
• triage suspected macOS malware
• investigate XPC and interprocess communication
• troubleshoot unexpected system behavior on a Mac
• capture Endpoint Security telemetry for threat hunting
• analyze what a suspicious macOS application does at runtime

When to choose

• you need a ProcMon-equivalent for macOS with a GUI
• you are doing macOS security research or malware analysis
• you want Endpoint Security event collection without writing your own ES client
• you run macOS 13.1+ and want a free, open-source monitoring tool

When to avoid

• you need monitoring on Linux or Windows
• you cannot grant Full Disk Access or install a System Extension
• you need headless or automated telemetry collection rather than interactive GUI analysis
• you need long-term centralized event storage or SIEM integration

Facets

application · maturity active

monitoring security logging security operating-systems developer-tools endpoint-security malware-analysis process-monitor swiftui system-extension security-research macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Brandon7CC/mac-monitor")