macosx Endpoint Security Intercept file transfer to iPhone

ES_EVENT_TYPE_NOTIFY_CREATE doesnt get triggerd if i copy a file to iPhone connected to mac device.

Yep. That’s because the iPhone isn’t mounted as a file system. While the specifics are not documented, it’s reasonable to think of the iPhone as a locally connect file server.

Also, ES_EVENT_TYPE_NOTIFY_MOUNT doesnt get triggered when an iphone is connected to a macos device

Ditto.

There isn’t a great path forward for you here. This sort of things crops up a lot, so I’ve post my general advice in Inferring High-Level Semantics from Low-Level Operations.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"