feat(macos): process and file telemetry via Endpoint Security

[mostafa]

Summary

Adds the macOS Endpoint Security sensor and wires it into the runtime in place of the placeholder. Process and file events map into the shared event model with Sysmon-compatible identifiers, so existing Sigma, YARA, and IOC detection works on macOS process and file activity.

• Add the endpoint-sec dependency and an EsfSensor that owns the ES client on a dedicated thread and surfaces client init failures (not root, missing entitlement, TCC denial) synchronously.
• Map process exec and exit: executable path, arguments, pid, parent pid, working directory, user, and a pid plus start-time key.
• Map file create, delete, rename, and modify (modify is derived from close-after-write to keep the high-volume close stream down to real content changes).
• Add the Endpoint Security entitlement plist and document ad-hoc signing and SIP requirements for local builds.

Process and file events emit the raw uid and defer username resolution to the normalizer, matching the Linux sensor.

Type of change

• feat / enhancement - new feature

Test plan

• Tested on Windows
• Tested on Linux
• Tested on macOS: unit tests for the event mappings, plus an ECS contract test for file events
• Existing tests pass (cargo test)
• New tests added (exec, exit, file mappings and ECS contract)

Note for maintainers: creating an Endpoint Security client requires root and the com.apple.developer.endpoint-security.client entitlement on signed and notarized builds. For local testing you can run with SIP and AMFI relaxed. The live client path was exercised manually under those conditions; the mappings are covered by unit tests.

Checklist

• Label added to this PR
• Docs updated (if behaviour changed)

Notes

Second of four in the #41 series, on top of #42 (merged). Verified on macOS arm64: cargo fmt --check, cargo clippy --locked --all-targets -- -D clippy::all, and cargo test --locked (134 passed) are all clean.

Part of #41.

[Karib0u]

Thanks for this — the threading model (client created/dropped on a dedicated thread, NOTIFY-only subscriptions, non-blocking try_send with drop-on-full) and the FFI-free RawExec/RawFile split are clean and genuinely testable. Two things I'd like addressed before merge (both verified against the Linux sensor), plus a couple of minor notes inline.

[mostafa]

Thanks, both good catches. Addressed against events.rs as the canonical Linux behavior:

1. File-modify event id parity (913f850)
You're right, the event id was mistakenly set to the action code. Modify now reports under EVENT_ID_FILE_CREATE (11) with action code 65, matching linux/events.rs:207. The test now asserts 11 so the parity is locked in.

2. Per-event getpwuid_r on the file hot path (34757d2)
Switched the sensor to emit the raw uid.to_string() for process and file events and defer username resolution to the normalizer, exactly like events.rs (which uses event.uid.to_string() for process, network, and file). This removes the directory-services lookup from Endpoint Security's dispatch queue entirely, so unlink and modified-close no longer risk the handler falling behind. I went with deferral rather than memoization to keep parity with the Linux sensor. lookup_username_by_uid is back to Linux-only since the macOS sensor no longer calls it.

Verified on macOS arm64: cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D clippy::all, and cargo test --locked (134 passed) are all clean.

[Karib0u]

Thanks for this, and for the fast turnaround on both review points.

The threading model is solid — owning the ES client on a dedicated thread, NOTIFY-only subscriptions, and the non-blocking try_send with drop-on-full are exactly the right calls for not stalling the dispatch queue. The FFI-free RawExec/RawFile split also makes the mappings genuinely unit-testable, which is great.

Both fixes look perfect:

• file-modify now reports under EventID 11 (action code stays 65), matching the Sysmon scheme the other sensors use, so Sigma file-change rules work cross-platform.
• raw uid on the sensor path, deferring like the Linux sensor — keeps getpwuid_r off the high-volume file path.

Verified CI is green on macOS, Linux, and Windows. Merging. 🎉

A couple of non-blocking follow-ups I'll track as issues (no action needed here): self-muting the agent's own log writes, and the stale "via libproc" comment. Really nice contribution to the macOS series.