"Instead it records those events in the log, and in Ventura and later makes them available to third-party software through Endpoint Security events."

Sounds like what malware did for decades