endpoint_security 0.1.0-universal-darwin

data/examples/eslogger_clone.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require "endpoint_security"
+
+ES::Recorder.new(events: ES::EventType.all_notify, out: $stdout).run

data/examples/execblock.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require "endpoint_security"
+
+blocked_team_id, blocked_signing_id = ARGV
+abort "usage: ruby execblock.rb TEAM_ID SIGNING_ID" unless blocked_team_id && blocked_signing_id
+
+ES::Client.open(auth_default: :allow) do |client|
+  client.subscribe(:auth_exec)
+  client.on(:auth_exec) do |message|
+    target = message.event.target
+    blocked = target.team_id == blocked_team_id && target.signing_id == blocked_signing_id
+    blocked ? message.deny!(cache: false) : message.allow!(cache: false)
+  end
+  client.run
+end

data/examples/filemon.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require "endpoint_security"
+
+events = %i[notify_open notify_write notify_create notify_unlink notify_rename]
+ES::Client.open do |client|
+  client.subscribe(events)
+  events.each { |event| client.on(event) { |message| puts JSON.generate(message.to_h) } }
+  client.run
+end

data/examples/procmon.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "endpoint_security"
+
+ES::Client.open do |client|
+  client.subscribe(:notify_exec, :notify_fork, :notify_exit)
+  client.on(:notify_exec) do |message|
+    puts "exec pid=#{message.event.target.pid} path=#{message.event.target.executable.path}"
+  end
+  client.on(:notify_fork) { |message| puts "fork child=#{message.event.child.pid}" }
+  client.on(:notify_exit) { |message| puts "exit pid=#{message.process.pid}" }
+  client.run
+end