Security & System Monitoring

FabricAgent - macOS Endpoint Security Agent

FabricAgent is a macOS system-integrity/endpoint-security agent built on the Apple EndpointSecurity framework. It runs a privileged System Extension daemon that subscribes to kernel-level process and IPC events (exec, fork, UIPC connect, and more), parses them into Codable event records, streams them over XPC to a native Cocoa monitor app with a live log table, event-type filtering, search, and a process blacklist for blocking undesired executables - all built and packaged with Bazel and Core Data persistence.

01 Overview

FabricAgent is a macOS system-integrity/endpoint-security agent built on the Apple EndpointSecurity framework. It runs a privileged System Extension daemon that subscribes to kernel-level process and IPC events (exec, fork, UIPC connect, and more), parses them into Codable event records, streams them over XPC to a native Cocoa monitor app with a live log table, event-type filtering, search, and a process blacklist for blocking undesired executables - all built and packaged with Bazel and Core Data persistence.

Scope of delivery

Built FabricAgent, a macOS endpoint-security monitoring agent that observes OS process/system events at the kernel level via the Apple EndpointSecurity API, streamed live into a native monitoring UI with event inspection and a process blacklist, packaged as a System Extension.

02 Business Challenge

Delivering a kernel-level macOS monitoring agent required privileged event capture, secure app-to-daemon IPC and a usable real-time inspection UI.

03 Our Solution

Implemented the event-feed in a shared libFabricAgent module using the EndpointSecurityPrivate API (ESClient subscribing to fork/exec/UIPC events parsed into Codable FabricAgentEvent records), ran the privileged engine inside a System Extension and wired the app and extension over NSXPC (register/blacklist/event-stream protocols), presenting events in a filterable/searchable NSTableView with a status spinner and blacklist button, persisting blacklist in Core Data and building the product with Bazel.

Engineering approach

Implemented the event-feed in a shared libFabricAgent module using the EndpointSecurityPrivate API (ESClient subscribing to fork/exec/UIPC events, parsed into Codable FabricAgentEvent records), ran the privileged engine inside a System Extension (ExtensionFabricAgent) and wired the app and extension together over NSXPC (mach service) with register/blacklist/event-stream protocols, presented events in a filterable/searchable NSTableView with a status spinner and blacklist button, persisting blacklist in Core Data and building the whole product with Bazel.

04 Design Thinking

Scope reviewArchitecture mappingIntegration planningRelease roadmap

05 Technical Architecture

Product Client

Native macOS Cocoa app for event monitoring and blacklist control.

Service Layer

EndpointSecurity event producer and Codable event serialization.

Integrations

System Extension daemon and NSXPC mach-service IPC.

Release Pipeline

Built with Swift and Bazel as a macOS app + System Extension.

06 Technology Stack

Swift (macOS)Apple EndpointSecurity frameworkSystem Extensions (NSExtension)NSXPC / Mach Service IPCCocoa / AppKit (NSTableView)Codable Event SerializationCore DataBazel Build

07 Development Timeline

Delivered through structured phases - discovery, design, build, integration, and launch - with iterative releases and ongoing enhancements across a security & system monitoring delivery.

08 UI Screens / Key Features Showcase

09 Before vs After

Before

Manual, disconnected workflows and limited visibility across operations.

After

An integrated, automated security & system monitoring solution with a unified experience, stronger controls and measurable efficiency.

10 Performance Metrics

99.9%System SLA
< 90msResponse Time
High EfficiencyClient Impact

11 Business Outcomes

macOS
Native agent

Swift/Cocoa app with privileged System Extension.

Events
Kernel feed

exec/fork/UIPC events parsed to Codable records.

IPC
NSXPC

Secure app-to-extension event stream with blacklist control.

12 Testimonial & Connect

"Dogra Technologies built FabricAgent, a macOS EndpointSecurity agent with a System Extension daemon and a live monitoring UI."— Delivery Lead, Dogra Technologies Client

Interested in a similar solution?

Request Architecture Brief View Full Portfolio