Reviewing the endpoint header files (ESMessage.h), I see an event type for UNIX-domain socket connections (es_event_uipc_connect_t) but no equivalent for a TCP/IP connection.
Can we not get TCP/IP related events in an endpoint monitor?
From ESMessage.h:
/**
* Union of all possible events that can appear in an es_message_t
*/
typedef union {
...
es_event_uipc_bind_t uipc_bind;
es_event_uipc_connect_t uipc_connect;
} es_events_t;
/**
* @brief Fired when a UNIX-domain socket is about to be connected.
*
* @field file Describes the socket file that the socket is bound to.
* @field domain The cmmunications domain of the socket (see socket(2)).
* @field type The type of the socket (see socket(2)).
* @field protocol The protocol of the socket (see socket(2)).
*/
typedef struct {
es_file_t * _Nullable file;
int domain;
int type;
int protocol;
uint8_t reserved[64];
} es_event_uipc_connect
