I am trying to identify if mac os upgrade or any app from app store upgrade has started via endpoint security client.
Background: I have an endpoint security client where I track file events or some process events.