FabricAgent is a macOS system-integrity/endpoint-security agent built on the Apple EndpointSecurity framework. It runs a privileged System Extension daemon that subscribes to kernel-level process and IPC events (exec, fork, UIPC connect, and more), parses them into Codable event records, streams them over XPC to a native Cocoa monitor app with a live log table, event-type filtering, search, and a process blacklist for blocking undesired executables - all built and packaged with Bazel and Core Data persistence.
FabricAgent is a macOS system-integrity/endpoint-security agent built on the Apple EndpointSecurity framework. It runs a privileged System Extension daemon that subscribes to kernel-level process and IPC events (exec, fork, UIPC connect, and more), parses them into Codable event records, streams them over XPC to a native Cocoa monitor app with a live log table, event-type filtering, search, and a process blacklist for blocking undesired executables - all built and packaged with Bazel and Core Data persistence.
Built FabricAgent, a macOS endpoint-security monitoring agent that observes OS process/system events at the kernel level via the Apple EndpointSecurity API, streamed live into a native monitoring UI with event inspection and a process blacklist, packaged as a System Extension.
Delivering a kernel-level macOS monitoring agent required privileged event capture, secure app-to-daemon IPC and a usable real-time inspection UI.
Implemented the event-feed in a shared libFabricAgent module using the EndpointSecurityPrivate API (ESClient subscribing to fork/exec/UIPC events parsed into Codable FabricAgentEvent records), ran the privileged engine inside a System Extension and wired the app and extension over NSXPC (register/blacklist/event-stream protocols), presenting events in a filterable/searchable NSTableView with a status spinner and blacklist button, persisting blacklist in Core Data and building the product with Bazel.
Implemented the event-feed in a shared libFabricAgent module using the EndpointSecurityPrivate API (ESClient subscribing to fork/exec/UIPC events, parsed into Codable FabricAgentEvent records), ran the privileged engine inside a System Extension (ExtensionFabricAgent) and wired the app and extension together over NSXPC (mach service) with register/blacklist/event-stream protocols, presented events in a filterable/searchable NSTableView with a status spinner and blacklist button, persisting blacklist in Core Data and building the whole product with Bazel.
Native macOS Cocoa app for event monitoring and blacklist control.
EndpointSecurity event producer and Codable event serialization.
System Extension daemon and NSXPC mach-service IPC.
Built with Swift and Bazel as a macOS app + System Extension.
Delivered through structured phases - discovery, design, build, integration, and launch - with iterative releases and ongoing enhancements across a security & system monitoring delivery.
Manual, disconnected workflows and limited visibility across operations.
An integrated, automated security & system monitoring solution with a unified experience, stronger controls and measurable efficiency.
Swift/Cocoa app with privileged System Extension.
exec/fork/UIPC events parsed to Codable records.
Secure app-to-extension event stream with blacklist control.