Mac Monitor
A macOS GUI tool for examining Endpoint Security events during security research, malware triage, and system troubleshooting.
Mac Monitor is Security & Privacy software for Mac. It needs macOS 13 or later.
About
Mac Monitor is a graphical macOS system-monitoring tool that records and enriches Apple Endpoint Security events for analysis. Its event data includes process, interprocess, memory, XPC, and file activity, with additional metadata to help investigate what happened.
- Adjust Endpoint Security event subscriptions while a trace is running, and mute paths to reduce unwanted event noise.
- Inspect event facts and metadata, correlate events by process, and group process activity to follow chains of execution.
- Filter events by type or initiating and target process paths; export full or partial traces as formatted JSON or JSONL.
- View an event distribution chart and explore process lineage from event details.
Install with brew install --cask mac-monitor. On first launch, macOS prompts you to allow the System Extension in System Settings and grant Full Disk Access to the Mac Monitor Security Extension. The app requires macOS 13 or later; its documentation recommends macOS 13.1 or later and 4 GB or more of memory. Apple Silicon is recommended, and Intel is also supported.
Sources: Project documentation · Homebrew cask
New What’s new in 2.1.0 Nov 22, 2025 · OpenNavo editorial
- EventsAdds optional subscriptions for
MPROTECT,LISTEXTATTR, andGETEXTATTR. - ScriptsCollects script content for
#!execution and supported interpreters. - ExperienceFlushes event batches slightly faster and expands the default mute set.
Install and uninstall
Homebrew runs the Mac-Monitor.pkg installer, which asks for an administrator password.
Install without Homebrew
Download the same file Homebrew uses: github.com/Brandon7CC/mac-monitor/releases/download/v2.1.0/Mac-Monitor.pkg
SHA-256 only checks that the download is complete; it is not a security certification. See the SHA-256 and download address
$ brew uninstall --cask \mac-monitorA regular uninstall removes the app and keeps its settings and caches.
$ brew uninstall --zap --cask \mac-monitor--zap also deletes the settings, caches and other files listed in the Homebrew definition. They can include data shared with other apps and cannot be restored, and it does not guarantee that nothing is left.See which files are removed
Facts and sources
- Version 2.1.0
- Recorded by Homebrew on Nov 22, 2025Released by the vendor on Nov 22, 2025
Questions
Is Mac Monitor safe?
Mac Monitor is in Homebrew’s official catalog and has not been disabled. Since September 2026, Homebrew disables apps that fail macOS Gatekeeper checks. When installing, Homebrew checks the download from github.com against its SHA-256 checksum. It was installed 27 times through Homebrew in the last 30 days.
Is Mac Monitor open source?
Mac Monitor’s source code is public on GitHub (Brandon7CC/mac-monitor) under the BSD-3-Clause license.
How do I completely uninstall Mac Monitor on a Mac?
Run brew uninstall --cask mac-monitor. It forgets 1 installer receipt. To delete its settings and caches as well, run brew uninstall --zap --cask mac-monitor. That also deletes 3 files and folders, including ~/.
Does Mac Monitor run on Apple silicon (M1 and later) Macs?
Homebrew installs it on both Apple silicon and Intel Macs, from the same download. It needs macOS 13 or later.
Where does Mac Monitor store its settings and data?
Its settings are in ~/. Its data is in ~/. These locations come from Homebrew’s clean-up list.
What is the latest version of Mac Monitor?
The latest version is 2.1.0, added to Homebrew on Nov 22, 2025. Mac Monitor updates itself; to update it with Homebrew, run brew upgrade --cask --greedy mac-monitor.
What else does installing Mac Monitor add?
It installs through a .pkg installer, which asks for an administrator password.