@llimllib @b0rk This is a list of the events it tracks and the data it collects for each: https://developer.apple.com/documentation/endpointsecurity/event_types