Native macOS (Swift/AppKit) endpoint security agent built on the Apple EndpointSecurity framework. It monitors process, network, and UIPC events in real time, maintains a CoreData-backed blacklist, and surfaces activity through a filterable event-log interface.
FabricAgent is a macOS endpoint security agent that taps the Apple EndpointSecurity framework to
observe system events (fork, exec, and UIPC traffic parsed from the native es_message_t
payloads). It ships as a SystemExtension and presents a clear, filterable log of what is happening
on the host.
Reasoning over low-level EndpointSecurity messages and building a reliable host agent requires careful system integration: registering as an ExtensionFabricAgent SystemExtension, coordinating the app and extension over NSXPC IPC (register, updateBlacklist/getBlacklist), and decoding device events into structured Codable FabricAgentEvent records.
Delivered a Swift + AppKit agent with a CoreData blacklist, real-time event capture into a log table with filtering and search, NSXPC-based communication between the main app and the system extension, and Bazel-based builds with a PFMoveApplication helper to relocate the app out of the Downloads quarantine.
Produced a functional endpoint-visibility agent that continuously logs blacklisted or noteworthy system activity and exposes it through an interactive UI — a foundation for enforcement policies and enterprise endpoint monitoring.
