2026

MacSentry: Mac security alerts on Telegram

An open-source macOS monitor in Swift: a root daemon, an Endpoint Security helper and a menu bar app that report remote access, persistence and tampering to Telegram before anyone can clean up.

Source code ↗
MacSentry: Mac security alerts on Telegram

Built with

  • Swift
  • macOS
  • Endpoint Security
  • launchd

Write-ups

  1. Endpoint Security on macOS without the entitlement: eslogger and Swift

    Reading eslogger from a root Swift helper: Full Disk Access, a one-pass Aho–Corasick prefilter on raw JSON, rules scoped to the program, and self-noise.

    Read →

  2. Making a Mac security monitor hard to silence

    Telling a reboot from kill -9, a Telegram bot that can delete its own alerts, processes that watch each other, an append-only log and a dead man’s switch.

    Read →

  3. From a polling Bash script to an event-driven Swift daemon on macOS

    How a macOS security daemon went from ~4.5% to ~0.4% of a core: APIs instead of forks, FSEvents and IOKit, ctime prefilters, and a netstat that hides sockets.

    Read →