Scenario: Copy file operation via Finder to an external device like USB Expected behavior: Endpoint Security Client should receive ES_EVENT_TYPE_NOTIFY_CLOSE event Current behavior: ES_EVENT_TYPE_NOTIFY_CLOSE is not been for the file being copied with Monterey 12.3 Beta. If you copy same file via cp command, ES_EVENT_TYPE_NOTIFY_CLOSE is seen Is this a bug?

The Endpoint Security framework provides open auth event. However certain application may just open a file to check size, access, but not read the content. Our use case is geared toward apply security when the application actually reads the content. Could Apple engineer confirm if there is any plan to support this? Had raised enhancement request long time back (Feedback FB6484629). Just thought of checking if there any update on the same. Any suggestions/comments?

The use case is enterprise Admin wants to enable/disable Safari Extension without user's involvement. Currently, the onus is on User to enable/disable the extension. In managed endpoint environment, the Admin needs control to enable certain extension silently/automatically (without user's involvement)