Via osquery is a work in progress (@sharvil has given talks about this) but the full capabilities are listed here https://developer.apple.com/documentation/endpointsecurity/event_types