https://developer.apple.com/documentation/endpointsecurity

This API allows for security applications to monitor for potentially malicious behaviors. As it is part of the System Extension and DriverKit, it shouldn’t crash the system kernel… but you do need to request for entitlement from Apple to build apps using that API (honestly probably a good thing, prevents spywares using it to spy on people).