Is there an Endpoint Security Event to be notified of Folder Copy?
No. ES operates at a low-level within the system and information about high-level Finder operations — copies, moves, trashing, and so on — does not percolate down to the ES level.
Also note that ES_EVENT_TYPE_AUTH_CLONE
is only delivered for volumes that support cloning. If you copy a file on a volume that doesn’t support cloning, the Finder it do it as a bunch of reads and writes.
If not, are there any future plans to include such an event in the ES
event list?
I can’t talk about The Future™. If you’d like us to add this support, I encourage you to file an enhancement request describing your requirements.
Please post your bug number, just for the record.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"