endpoint_security 0.1.0-universal-darwin

data/lib/endpoint_security/generated/event_types.rb

@@ -0,0 +1,520 @@
+# frozen_string_literal: true
+
+# Generated by codegen/run.rb. Do not edit.
+
+module EndpointSecurity
+  # Event names and numeric values from the build SDK.
+  module EventType
+    # The +auth_exec+ event.
+    AUTH_EXEC = :auth_exec
+    # The +auth_open+ event.
+    AUTH_OPEN = :auth_open
+    # The +auth_kextload+ event.
+    AUTH_KEXTLOAD = :auth_kextload
+    # The +auth_mmap+ event.
+    AUTH_MMAP = :auth_mmap
+    # The +auth_mprotect+ event.
+    AUTH_MPROTECT = :auth_mprotect
+    # The +auth_mount+ event.
+    AUTH_MOUNT = :auth_mount
+    # The +auth_rename+ event.
+    AUTH_RENAME = :auth_rename
+    # The +auth_signal+ event.
+    AUTH_SIGNAL = :auth_signal
+    # The +auth_unlink+ event.
+    AUTH_UNLINK = :auth_unlink
+    # The +notify_exec+ event.
+    NOTIFY_EXEC = :notify_exec
+    # The +notify_open+ event.
+    NOTIFY_OPEN = :notify_open
+    # The +notify_fork+ event.
+    NOTIFY_FORK = :notify_fork
+    # The +notify_close+ event.
+    NOTIFY_CLOSE = :notify_close
+    # The +notify_create+ event.
+    NOTIFY_CREATE = :notify_create
+    # The +notify_exchangedata+ event.
+    NOTIFY_EXCHANGEDATA = :notify_exchangedata
+    # The +notify_exit+ event.
+    NOTIFY_EXIT = :notify_exit
+    # The +notify_get_task+ event.
+    NOTIFY_GET_TASK = :notify_get_task
+    # The +notify_kextload+ event.
+    NOTIFY_KEXTLOAD = :notify_kextload
+    # The +notify_kextunload+ event.
+    NOTIFY_KEXTUNLOAD = :notify_kextunload
+    # The +notify_link+ event.
+    NOTIFY_LINK = :notify_link
+    # The +notify_mmap+ event.
+    NOTIFY_MMAP = :notify_mmap
+    # The +notify_mprotect+ event.
+    NOTIFY_MPROTECT = :notify_mprotect
+    # The +notify_mount+ event.
+    NOTIFY_MOUNT = :notify_mount
+    # The +notify_unmount+ event.
+    NOTIFY_UNMOUNT = :notify_unmount
+    # The +notify_iokit_open+ event.
+    NOTIFY_IOKIT_OPEN = :notify_iokit_open
+    # The +notify_rename+ event.
+    NOTIFY_RENAME = :notify_rename
+    # The +notify_setattrlist+ event.
+    NOTIFY_SETATTRLIST = :notify_setattrlist
+    # The +notify_setextattr+ event.
+    NOTIFY_SETEXTATTR = :notify_setextattr
+    # The +notify_setflags+ event.
+    NOTIFY_SETFLAGS = :notify_setflags
+    # The +notify_setmode+ event.
+    NOTIFY_SETMODE = :notify_setmode
+    # The +notify_setowner+ event.
+    NOTIFY_SETOWNER = :notify_setowner
+    # The +notify_signal+ event.
+    NOTIFY_SIGNAL = :notify_signal
+    # The +notify_unlink+ event.
+    NOTIFY_UNLINK = :notify_unlink
+    # The +notify_write+ event.
+    NOTIFY_WRITE = :notify_write
+    # The +auth_file_provider_materialize+ event.
+    AUTH_FILE_PROVIDER_MATERIALIZE = :auth_file_provider_materialize
+    # The +notify_file_provider_materialize+ event.
+    NOTIFY_FILE_PROVIDER_MATERIALIZE = :notify_file_provider_materialize
+    # The +auth_file_provider_update+ event.
+    AUTH_FILE_PROVIDER_UPDATE = :auth_file_provider_update
+    # The +notify_file_provider_update+ event.
+    NOTIFY_FILE_PROVIDER_UPDATE = :notify_file_provider_update
+    # The +auth_readlink+ event.
+    AUTH_READLINK = :auth_readlink
+    # The +notify_readlink+ event.
+    NOTIFY_READLINK = :notify_readlink
+    # The +auth_truncate+ event.
+    AUTH_TRUNCATE = :auth_truncate
+    # The +notify_truncate+ event.
+    NOTIFY_TRUNCATE = :notify_truncate
+    # The +auth_link+ event.
+    AUTH_LINK = :auth_link
+    # The +notify_lookup+ event.
+    NOTIFY_LOOKUP = :notify_lookup
+    # The +auth_create+ event.
+    AUTH_CREATE = :auth_create
+    # The +auth_setattrlist+ event.
+    AUTH_SETATTRLIST = :auth_setattrlist
+    # The +auth_setextattr+ event.
+    AUTH_SETEXTATTR = :auth_setextattr
+    # The +auth_setflags+ event.
+    AUTH_SETFLAGS = :auth_setflags
+    # The +auth_setmode+ event.
+    AUTH_SETMODE = :auth_setmode
+    # The +auth_setowner+ event.
+    AUTH_SETOWNER = :auth_setowner
+    # The +auth_chdir+ event.
+    AUTH_CHDIR = :auth_chdir
+    # The +notify_chdir+ event.
+    NOTIFY_CHDIR = :notify_chdir
+    # The +auth_getattrlist+ event.
+    AUTH_GETATTRLIST = :auth_getattrlist
+    # The +notify_getattrlist+ event.
+    NOTIFY_GETATTRLIST = :notify_getattrlist
+    # The +notify_stat+ event.
+    NOTIFY_STAT = :notify_stat
+    # The +notify_access+ event.
+    NOTIFY_ACCESS = :notify_access
+    # The +auth_chroot+ event.
+    AUTH_CHROOT = :auth_chroot
+    # The +notify_chroot+ event.
+    NOTIFY_CHROOT = :notify_chroot
+    # The +auth_utimes+ event.
+    AUTH_UTIMES = :auth_utimes
+    # The +notify_utimes+ event.
+    NOTIFY_UTIMES = :notify_utimes
+    # The +auth_clone+ event.
+    AUTH_CLONE = :auth_clone
+    # The +notify_clone+ event.
+    NOTIFY_CLONE = :notify_clone
+    # The +notify_fcntl+ event.
+    NOTIFY_FCNTL = :notify_fcntl
+    # The +auth_getextattr+ event.
+    AUTH_GETEXTATTR = :auth_getextattr
+    # The +notify_getextattr+ event.
+    NOTIFY_GETEXTATTR = :notify_getextattr
+    # The +auth_listextattr+ event.
+    AUTH_LISTEXTATTR = :auth_listextattr
+    # The +notify_listextattr+ event.
+    NOTIFY_LISTEXTATTR = :notify_listextattr
+    # The +auth_readdir+ event.
+    AUTH_READDIR = :auth_readdir
+    # The +notify_readdir+ event.
+    NOTIFY_READDIR = :notify_readdir
+    # The +auth_deleteextattr+ event.
+    AUTH_DELETEEXTATTR = :auth_deleteextattr
+    # The +notify_deleteextattr+ event.
+    NOTIFY_DELETEEXTATTR = :notify_deleteextattr
+    # The +auth_fsgetpath+ event.
+    AUTH_FSGETPATH = :auth_fsgetpath
+    # The +notify_fsgetpath+ event.
+    NOTIFY_FSGETPATH = :notify_fsgetpath
+    # The +notify_dup+ event.
+    NOTIFY_DUP = :notify_dup
+    # The +auth_settime+ event.
+    AUTH_SETTIME = :auth_settime
+    # The +notify_settime+ event.
+    NOTIFY_SETTIME = :notify_settime
+    # The +notify_uipc_bind+ event.
+    NOTIFY_UIPC_BIND = :notify_uipc_bind
+    # The +auth_uipc_bind+ event.
+    AUTH_UIPC_BIND = :auth_uipc_bind
+    # The +notify_uipc_connect+ event.
+    NOTIFY_UIPC_CONNECT = :notify_uipc_connect
+    # The +auth_uipc_connect+ event.
+    AUTH_UIPC_CONNECT = :auth_uipc_connect
+    # The +auth_exchangedata+ event.
+    AUTH_EXCHANGEDATA = :auth_exchangedata
+    # The +auth_setacl+ event.
+    AUTH_SETACL = :auth_setacl
+    # The +notify_setacl+ event.
+    NOTIFY_SETACL = :notify_setacl
+    # The +notify_pty_grant+ event.
+    NOTIFY_PTY_GRANT = :notify_pty_grant
+    # The +notify_pty_close+ event.
+    NOTIFY_PTY_CLOSE = :notify_pty_close
+    # The +auth_proc_check+ event.
+    AUTH_PROC_CHECK = :auth_proc_check
+    # The +notify_proc_check+ event.
+    NOTIFY_PROC_CHECK = :notify_proc_check
+    # The +auth_get_task+ event.
+    AUTH_GET_TASK = :auth_get_task
+    # The +auth_searchfs+ event.
+    AUTH_SEARCHFS = :auth_searchfs
+    # The +notify_searchfs+ event.
+    NOTIFY_SEARCHFS = :notify_searchfs
+    # The +auth_fcntl+ event.
+    AUTH_FCNTL = :auth_fcntl
+    # The +auth_iokit_open+ event.
+    AUTH_IOKIT_OPEN = :auth_iokit_open
+    # The +auth_proc_suspend_resume+ event.
+    AUTH_PROC_SUSPEND_RESUME = :auth_proc_suspend_resume
+    # The +notify_proc_suspend_resume+ event.
+    NOTIFY_PROC_SUSPEND_RESUME = :notify_proc_suspend_resume
+    # The +notify_cs_invalidated+ event.
+    NOTIFY_CS_INVALIDATED = :notify_cs_invalidated
+    # The +notify_get_task_name+ event.
+    NOTIFY_GET_TASK_NAME = :notify_get_task_name
+    # The +notify_trace+ event.
+    NOTIFY_TRACE = :notify_trace
+    # The +notify_remote_thread_create+ event.
+    NOTIFY_REMOTE_THREAD_CREATE = :notify_remote_thread_create
+    # The +auth_remount+ event.
+    AUTH_REMOUNT = :auth_remount
+    # The +notify_remount+ event.
+    NOTIFY_REMOUNT = :notify_remount
+    # The +auth_get_task_read+ event.
+    AUTH_GET_TASK_READ = :auth_get_task_read
+    # The +notify_get_task_read+ event.
+    NOTIFY_GET_TASK_READ = :notify_get_task_read
+    # The +notify_get_task_inspect+ event.
+    NOTIFY_GET_TASK_INSPECT = :notify_get_task_inspect
+    # The +notify_setuid+ event.
+    NOTIFY_SETUID = :notify_setuid
+    # The +notify_setgid+ event.
+    NOTIFY_SETGID = :notify_setgid
+    # The +notify_seteuid+ event.
+    NOTIFY_SETEUID = :notify_seteuid
+    # The +notify_setegid+ event.
+    NOTIFY_SETEGID = :notify_setegid
+    # The +notify_setreuid+ event.
+    NOTIFY_SETREUID = :notify_setreuid
+    # The +notify_setregid+ event.
+    NOTIFY_SETREGID = :notify_setregid
+    # The +auth_copyfile+ event.
+    AUTH_COPYFILE = :auth_copyfile
+    # The +notify_copyfile+ event.
+    NOTIFY_COPYFILE = :notify_copyfile
+    # The +notify_authentication+ event.
+    NOTIFY_AUTHENTICATION = :notify_authentication
+    # The +notify_xp_malware_detected+ event.
+    NOTIFY_XP_MALWARE_DETECTED = :notify_xp_malware_detected
+    # The +notify_xp_malware_remediated+ event.
+    NOTIFY_XP_MALWARE_REMEDIATED = :notify_xp_malware_remediated
+    # The +notify_lw_session_login+ event.
+    NOTIFY_LW_SESSION_LOGIN = :notify_lw_session_login
+    # The +notify_lw_session_logout+ event.
+    NOTIFY_LW_SESSION_LOGOUT = :notify_lw_session_logout
+    # The +notify_lw_session_lock+ event.
+    NOTIFY_LW_SESSION_LOCK = :notify_lw_session_lock
+    # The +notify_lw_session_unlock+ event.
+    NOTIFY_LW_SESSION_UNLOCK = :notify_lw_session_unlock
+    # The +notify_screensharing_attach+ event.
+    NOTIFY_SCREENSHARING_ATTACH = :notify_screensharing_attach
+    # The +notify_screensharing_detach+ event.
+    NOTIFY_SCREENSHARING_DETACH = :notify_screensharing_detach
+    # The +notify_openssh_login+ event.
+    NOTIFY_OPENSSH_LOGIN = :notify_openssh_login
+    # The +notify_openssh_logout+ event.
+    NOTIFY_OPENSSH_LOGOUT = :notify_openssh_logout
+    # The +notify_login_login+ event.
+    NOTIFY_LOGIN_LOGIN = :notify_login_login
+    # The +notify_login_logout+ event.
+    NOTIFY_LOGIN_LOGOUT = :notify_login_logout
+    # The +notify_btm_launch_item_add+ event.
+    NOTIFY_BTM_LAUNCH_ITEM_ADD = :notify_btm_launch_item_add
+    # The +notify_btm_launch_item_remove+ event.
+    NOTIFY_BTM_LAUNCH_ITEM_REMOVE = :notify_btm_launch_item_remove
+    # The +notify_profile_add+ event.
+    NOTIFY_PROFILE_ADD = :notify_profile_add
+    # The +notify_profile_remove+ event.
+    NOTIFY_PROFILE_REMOVE = :notify_profile_remove
+    # The +notify_su+ event.
+    NOTIFY_SU = :notify_su
+    # The +notify_authorization_petition+ event.
+    NOTIFY_AUTHORIZATION_PETITION = :notify_authorization_petition
+    # The +notify_authorization_judgement+ event.
+    NOTIFY_AUTHORIZATION_JUDGEMENT = :notify_authorization_judgement
+    # The +notify_sudo+ event.
+    NOTIFY_SUDO = :notify_sudo
+    # The +notify_od_group_add+ event.
+    NOTIFY_OD_GROUP_ADD = :notify_od_group_add
+    # The +notify_od_group_remove+ event.
+    NOTIFY_OD_GROUP_REMOVE = :notify_od_group_remove
+    # The +notify_od_group_set+ event.
+    NOTIFY_OD_GROUP_SET = :notify_od_group_set
+    # The +notify_od_modify_password+ event.
+    NOTIFY_OD_MODIFY_PASSWORD = :notify_od_modify_password
+    # The +notify_od_disable_user+ event.
+    NOTIFY_OD_DISABLE_USER = :notify_od_disable_user
+    # The +notify_od_enable_user+ event.
+    NOTIFY_OD_ENABLE_USER = :notify_od_enable_user
+    # The +notify_od_attribute_value_add+ event.
+    NOTIFY_OD_ATTRIBUTE_VALUE_ADD = :notify_od_attribute_value_add
+    # The +notify_od_attribute_value_remove+ event.
+    NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE = :notify_od_attribute_value_remove
+    # The +notify_od_attribute_set+ event.
+    NOTIFY_OD_ATTRIBUTE_SET = :notify_od_attribute_set
+    # The +notify_od_create_user+ event.
+    NOTIFY_OD_CREATE_USER = :notify_od_create_user
+    # The +notify_od_create_group+ event.
+    NOTIFY_OD_CREATE_GROUP = :notify_od_create_group
+    # The +notify_od_delete_user+ event.
+    NOTIFY_OD_DELETE_USER = :notify_od_delete_user
+    # The +notify_od_delete_group+ event.
+    NOTIFY_OD_DELETE_GROUP = :notify_od_delete_group
+    # The +notify_xpc_connect+ event.
+    NOTIFY_XPC_CONNECT = :notify_xpc_connect
+    # The +notify_gatekeeper_user_override+ event.
+    NOTIFY_GATEKEEPER_USER_OVERRIDE = :notify_gatekeeper_user_override
+    # The +notify_tcc_modify+ event.
+    NOTIFY_TCC_MODIFY = :notify_tcc_modify
+    # The +reserved_0+ event.
+    RESERVED_0 = :reserved_0
+    # The +reserved_1+ event.
+    RESERVED_1 = :reserved_1
+    # The +reserved_2+ event.
+    RESERVED_2 = :reserved_2
+    # The +reserved_3+ event.
+    RESERVED_3 = :reserved_3
+    # The +reserved_4+ event.
+    RESERVED_4 = :reserved_4
+    # The +reserved_5+ event.
+    RESERVED_5 = :reserved_5
+    # The +reserved_6+ event.
+    RESERVED_6 = :reserved_6
+    # The +reserved_7+ event.
+    RESERVED_7 = :reserved_7
+    # The +reserved_8+ event.
+    RESERVED_8 = :reserved_8
+    # Exclusive upper bound for event enum values.
+    LAST = 157
+    # Event symbols keyed by their SDK enum values.
+    SYMBOL_TO_VALUE = {
+      auth_exec: 0,
+      auth_open: 1,
+      auth_kextload: 2,
+      auth_mmap: 3,
+      auth_mprotect: 4,
+      auth_mount: 5,
+      auth_rename: 6,
+      auth_signal: 7,
+      auth_unlink: 8,
+      notify_exec: 9,
+      notify_open: 10,
+      notify_fork: 11,
+      notify_close: 12,
+      notify_create: 13,
+      notify_exchangedata: 14,
+      notify_exit: 15,
+      notify_get_task: 16,
+      notify_kextload: 17,
+      notify_kextunload: 18,
+      notify_link: 19,
+      notify_mmap: 20,
+      notify_mprotect: 21,
+      notify_mount: 22,
+      notify_unmount: 23,
+      notify_iokit_open: 24,
+      notify_rename: 25,
+      notify_setattrlist: 26,
+      notify_setextattr: 27,
+      notify_setflags: 28,
+      notify_setmode: 29,
+      notify_setowner: 30,
+      notify_signal: 31,
+      notify_unlink: 32,
+      notify_write: 33,
+      auth_file_provider_materialize: 34,
+      notify_file_provider_materialize: 35,
+      auth_file_provider_update: 36,
+      notify_file_provider_update: 37,
+      auth_readlink: 38,
+      notify_readlink: 39,
+      auth_truncate: 40,
+      notify_truncate: 41,
+      auth_link: 42,
+      notify_lookup: 43,
+      auth_create: 44,
+      auth_setattrlist: 45,
+      auth_setextattr: 46,
+      auth_setflags: 47,
+      auth_setmode: 48,
+      auth_setowner: 49,
+      auth_chdir: 50,
+      notify_chdir: 51,
+      auth_getattrlist: 52,
+      notify_getattrlist: 53,
+      notify_stat: 54,
+      notify_access: 55,
+      auth_chroot: 56,
+      notify_chroot: 57,
+      auth_utimes: 58,
+      notify_utimes: 59,
+      auth_clone: 60,
+      notify_clone: 61,
+      notify_fcntl: 62,
+      auth_getextattr: 63,
+      notify_getextattr: 64,
+      auth_listextattr: 65,
+      notify_listextattr: 66,
+      auth_readdir: 67,
+      notify_readdir: 68,
+      auth_deleteextattr: 69,
+      notify_deleteextattr: 70,
+      auth_fsgetpath: 71,
+      notify_fsgetpath: 72,
+      notify_dup: 73,
+      auth_settime: 74,
+      notify_settime: 75,
+      notify_uipc_bind: 76,
+      auth_uipc_bind: 77,
+      notify_uipc_connect: 78,
+      auth_uipc_connect: 79,
+      auth_exchangedata: 80,
+      auth_setacl: 81,
+      notify_setacl: 82,
+      notify_pty_grant: 83,
+      notify_pty_close: 84,
+      auth_proc_check: 85,
+      notify_proc_check: 86,
+      auth_get_task: 87,
+      auth_searchfs: 88,
+      notify_searchfs: 89,
+      auth_fcntl: 90,
+      auth_iokit_open: 91,
+      auth_proc_suspend_resume: 92,
+      notify_proc_suspend_resume: 93,
+      notify_cs_invalidated: 94,
+      notify_get_task_name: 95,
+      notify_trace: 96,
+      notify_remote_thread_create: 97,
+      auth_remount: 98,
+      notify_remount: 99,
+      auth_get_task_read: 100,
+      notify_get_task_read: 101,
+      notify_get_task_inspect: 102,
+      notify_setuid: 103,
+      notify_setgid: 104,
+      notify_seteuid: 105,
+      notify_setegid: 106,
+      notify_setreuid: 107,
+      notify_setregid: 108,
+      auth_copyfile: 109,
+      notify_copyfile: 110,
+      notify_authentication: 111,
+      notify_xp_malware_detected: 112,
+      notify_xp_malware_remediated: 113,
+      notify_lw_session_login: 114,
+      notify_lw_session_logout: 115,
+      notify_lw_session_lock: 116,
+      notify_lw_session_unlock: 117,
+      notify_screensharing_attach: 118,
+      notify_screensharing_detach: 119,
+      notify_openssh_login: 120,
+      notify_openssh_logout: 121,
+      notify_login_login: 122,
+      notify_login_logout: 123,
+      notify_btm_launch_item_add: 124,
+      notify_btm_launch_item_remove: 125,
+      notify_profile_add: 126,
+      notify_profile_remove: 127,
+      notify_su: 128,
+      notify_authorization_petition: 129,
+      notify_authorization_judgement: 130,
+      notify_sudo: 131,
+      notify_od_group_add: 132,
+      notify_od_group_remove: 133,
+      notify_od_group_set: 134,
+      notify_od_modify_password: 135,
+      notify_od_disable_user: 136,
+      notify_od_enable_user: 137,
+      notify_od_attribute_value_add: 138,
+      notify_od_attribute_value_remove: 139,
+      notify_od_attribute_set: 140,
+      notify_od_create_user: 141,
+      notify_od_create_group: 142,
+      notify_od_delete_user: 143,
+      notify_od_delete_group: 144,
+      notify_xpc_connect: 145,
+      notify_gatekeeper_user_override: 146,
+      notify_tcc_modify: 147,
+      reserved_0: 148,
+      reserved_1: 149,
+      reserved_2: 150,
+      reserved_3: 151,
+      reserved_4: 152,
+      reserved_5: 153,
+      reserved_6: 154,
+      reserved_7: 155,
+      reserved_8: 156
+    }.freeze
+    # SDK enum values keyed by event symbol.
+    VALUE_TO_SYMBOL = SYMBOL_TO_VALUE.invert.freeze
+    # All events known to the build SDK.
+    ALL = SYMBOL_TO_VALUE.keys.freeze
+    # All authorization events.
+    ALL_AUTH = ALL.select { |event| event.to_s.start_with?("auth_") }.freeze
+    # All notification events.
+    ALL_NOTIFY = ALL.select { |event| event.to_s.start_with?("notify_") }.freeze
+    # Undocumented reserved event slots.
+    RESERVED = [:reserved_0, :reserved_1, :reserved_2, :reserved_3, :reserved_4, :reserved_5, :reserved_6, :reserved_7, :reserved_8].freeze
+    # Events for which Endpoint Security accepts cached responses.
+    CACHEABLE = [:auth_exec, :auth_open, :auth_mmap, :auth_mount, :auth_setflags, :auth_setmode, :auth_setowner, :auth_chdir, :auth_getattrlist, :auth_chroot, :auth_utimes, :auth_getextattr, :auth_listextattr, :auth_readdir, :auth_fsgetpath, :auth_uipc_connect, :auth_proc_check, :auth_get_task, :auth_searchfs, :auth_get_task_read].freeze
+
+    module_function
+
+    # @return [Array<Symbol>] all events
+    def all = ALL
+    # @return [Array<Symbol>] authorization events
+    def all_auth = ALL_AUTH
+    # @return [Array<Symbol>] notification events
+    def all_notify = ALL_NOTIFY
+    # @return [Boolean] whether +event+ is an authorization event
+    def auth?(event) = event.to_s.start_with?("auth_")
+    # @return [Boolean] whether +event+ is a notification event
+    def notify?(event) = event.to_s.start_with?("notify_")
+    # @return [Boolean] whether +event+ is an undocumented reserved slot
+    def reserved?(event) = RESERVED.include?(event.to_sym)
+    # @return [Boolean] whether +event+ accepts a cached response
+    def cacheable?(event) = CACHEABLE.include?(event.to_sym)
+    # @return [Boolean] whether +event+ uses a flags response
+    def flags_response?(event) = event.to_sym == :auth_open
+    # @return [Integer] SDK enum value for +event+
+    def value(event) = SYMBOL_TO_VALUE.fetch(event.to_sym)
+    # @return [Symbol, Integer] event symbol, or +value+ when unknown
+    def symbol(value) = VALUE_TO_SYMBOL.fetch(value, value)
+  end
+end

data/lib/endpoint_security/message.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module EndpointSecurity
+  # A retained Endpoint Security message delivered to a handler.
+  class Message
+    # @return [Time]
+    def deadline_at
+      Time.now + time_left
+    end
+
+    # @return [Hash]
+    def to_h
+      {
+        version: version,
+        event_type: event_type,
+        action_type: action_type,
+        result: result,
+        time: time,
+        mach_time: mach_time,
+        deadline: deadline,
+        seq_num: seq_num,
+        global_seq_num: global_seq_num,
+        process: process&.to_h,
+        thread: thread&.to_h,
+        event: event&.to_h
+      }
+    end
+  end
+end