I am trying to identify if mac os upgrade or any app from app store upgrade has started via endpoint security client.
Background: I have an endpoint security client where I track file events or some process events.

What I have done: Whenever we run the mac os the software update process is already running,which makes it difficult to identify if user has triggered mac os upgrade.