Comment by SmellyPotato22

For macOS you all should look into integrating with the Endpoint Security API. It also provides larger subset of events than just syscalls. You can see them all with `eslogger --list-events`.

https://developer.apple.com/documentation/endpointsecurity