About
Mac Monitor is a stand-alone system monitoring tool for macOS built for security research, malware triage, and system troubleshooting. It uses Apple's Endpoint Security and System Extension APIs to collect and enrich system events, including process, interprocess, memory, XPC, and file events, and displays them graphically with metadata that helps users understand what happened.
Key capabilities described on the site include detailed "event facts" windows with curated metadata for each event, event correlation at the process level, process grouping to show chains of activity around exec and fork events, dynamic runtime event subscriptions, and path muting to reduce noise. Users can also filter and remove events from view without destroying them.
The project lists macOS 13.1 (Ventura) or later as a requirement, with 4GB+ of system memory recommended and Apple Silicon suggested though Intel is supported. It can be installed via Homebrew or a downloadable installer, and requires granting System Extension approval and Full Disk Access during setup.
What's new
All release notesHomebrew cask mac-monitor 2.1.0 (sha256 69734a00363039fe9cb74cbc54567bb242ca83ef73002149706625492ee12033).