Right now I am going to build a service which using endpoint-security client api.
I see that I can get the the process id by pid_t pid = audit_token_to_pid(message->process->audit_token);. But I want to get the thread id of the process which try to access the file system. Is there any way I can get it?
blknit
Users receive reputation points by contributing quality content to the forums.
Posts include post and replies published on the forums.
Post authors can mark replies as Accepted to indicate successful solutions.
Apple Developer Forums admins can mark replies as Apple Recommended to indicate an approved solution
Last seen
User for