I am currently monitoring ES_EVENT_TYPE_AUTH_CLONE events in my Endpoint Security client, but it seems to only respond to file, not folder, copies from finder. Is there any existing event to allow notification of a copy of a folder in finder? If not, are there any future plans to include such an event in the ES event list?
Thank you.
Is there an Endpoint Security Event to be notified of Folder Copy?
No. ES operates at a low-level within the system and information about high-level Finder operations — copies, moves, trashing, and so on — does not percolate down to the ES level.
Also note that ES_EVENT_TYPE_AUTH_CLONE is only delivered for volumes that support cloning. If you copy a file on a volume that doesn’t support cloning, the Finder it do it as a bunch of reads and writes.
If not, are there any future plans to include such an event in the ES event list?
I can’t talk about The Future™. If you’d like us to add this support, I encourage you to file an enhancement request describing your requirements.
Please post your bug number, just for the record.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Quinn,
I'll add my request: FB10320938
Cheers