EndpointSecurity macOS 10.15.6 to 11.0 API Differences

ESMessage.h

Added es_thread_t

Added es_thread_state_t

Added es_event_remount_t

Added es_event_get_task_name_t

Added es_event_searchfs_t

Added ES_PROC_SUSPEND_RESUME_TYPE_SUSPEND

Added ES_PROC_SUSPEND_RESUME_TYPE_RESUME

Added ES_PROC_SUSPEND_RESUME_TYPE_SHUTDOWN_SOCKETS

Added es_proc_suspend_resume_type_t

Added es_event_proc_suspend_resume_t

Added es_event_cs_invalidated_t

Added es_event_trace_t

Added es_event_remote_thread_create_t

Added es_retain_message()

Added es_release_message()

Added es_exec_fd_count()

Added es_exec_fd()

Modified es_message_size()

	Availability	Deprecation Message
From	Available	none
To	Deprecated	Please use es_retain_message to retain a message. Do not use this in conjunction with attempting to copy a message, doing so will result in use-after-free bugs.

Modified es_copy_message()

	Availability	Deprecation Message
From	Available	none
To	Deprecated	Use es_retain_message to retain a message.

Modified es_free_message()

	Availability	Deprecation Message
From	Available	none
To	Deprecated	Use es_release_message to release a message.

ESTypes.h

Added ES_EVENT_TYPE_AUTH_SEARCHFS

Added ES_EVENT_TYPE_NOTIFY_SEARCHFS

Added ES_EVENT_TYPE_AUTH_FCNTL

Added ES_EVENT_TYPE_AUTH_IOKIT_OPEN

Added ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME

Added ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME

Added ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED

Added ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME

Added ES_EVENT_TYPE_NOTIFY_TRACE

Added ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE

Added ES_EVENT_TYPE_AUTH_REMOUNT

Added ES_EVENT_TYPE_NOTIFY_REMOUNT