Crescendo is a free, open-source macOS utility that streams system events — process launches, network connections, file operations, and more — live as they happen, giving you an unfiltered window into what your Mac is actually doing at any moment.
What is Crescendo?
Crescendo is a real-time system-event monitor for macOS, built on Apple's Endpoint Security framework. Think of it as a flight recorder for your Mac's kernel activity: every time a process spawns, a file gets touched, or an outbound connection is attempted, Crescendo surfaces that event in its live feed within milliseconds. It is free to download and the source code is public on GitHub under the SuprHackerSteve account.
The app fills a genuine gap in the Mac ecosystem. Activity Monitor tells you what is running right now; Console shows you logs that already happened. Crescendo sits between those two worlds, giving you a stream of causality — you can watch a single click fan out into dozens of child processes, file reads, and network handshakes in real time.
What does Crescendo do best?
Crescendo excels at rapid, ad-hoc security triage — watching a suspicious binary run in a sandboxed account and observing exactly what it reaches for before you decide whether to keep it. The event types it covers span the essentials a power user or security researcher actually cares about:
- Process events — exec, fork, exit, and signal delivery
- File-system events — creates, renames, unlinks, attribute changes
- Network events — TCP/UDP connection attempts, DNS lookups
- Authentication events — sudo calls, privilege escalation attempts
Because it taps Apple's Endpoint Security framework directly — the same subsystem that enterprise EDR tools use — the data is authoritative and low-latency, not polled. The live feed updates as fast as your display can refresh, and you can filter by process name, event type, or path substring to cut the noise down to exactly what matters.
Is Crescendo free?
Yes — Crescendo is completely free, with no paid tier, no account required, and no telemetry phoning home. It is open source (available on GitHub), so you can audit the code yourself before granting it the elevated permissions it needs. The only "cost" is a Full Disk Access grant and the Endpoint Security entitlement, both of which macOS will prompt you for on first launch.
Who should use Crescendo?
Security researchers and threat hunters will get the most out of Crescendo immediately — it is the kind of tool you reach for when you need to understand precisely what a piece of software does rather than what its documentation claims. But it is also genuinely useful for curious power users who want to understand why their Mac is suddenly pegging a disk or why a background process keeps waking from sleep.
If you have ever used Sysinternals Process Monitor on Windows and lamented the absence of a native equivalent on macOS, Crescendo is the closest thing Apple's modern security model will permit. It is not a GUI rival to enterprise tools like Jamf Protect or SentinelOne, but for a solo developer or researcher who wants zero-cost, zero-subscription visibility, it punches well above its weight.
What are the best Crescendo alternatives?
Crescendo occupies a fairly specific niche, but a few tools overlap with parts of its feature set. Objective-See's ProcessMonitor covers the process and network layer with a polished UI and is probably the most direct comparison — both use Endpoint Security under the hood, though ProcessMonitor has a longer track record and broader community recognition. FSMonitor focuses exclusively on file-system changes and offers a friendlier interface for that narrower use case. For network-only monitoring, Little Snitch remains the gold standard but costs money and is built around blocking, not observing. Apple's built-in Console and the log stream command-line tool give you unified log output but without the structured, filterable event model Crescendo provides.
Where Crescendo wins is the combination of breadth, zero cost, and open-source transparency. You are not trusting a binary you cannot inspect — you can read every line of Swift that processes your Endpoint Security events.
How does Crescendo compare to Objective-See's ProcessMonitor?
ProcessMonitor, from Patrick Wardle's Objective-See suite, has a more polished interface and benefits from years of active community use in the macOS security scene. Crescendo trades some UI polish for a broader event footprint — it captures network and authentication events in the same feed where ProcessMonitor focuses primarily on process activity. Both are free and open source. I reach for ProcessMonitor when I want a quick process-lineage check, and Crescendo when I need to watch everything a binary touches across all event categories simultaneously. They complement each other rather than compete cleanly.
