Events - Hilt Documentation

The events endpoint returns the raw activity stream behind a finding — every process execution, file operation, and network flow the Linux Collector recorded — so you can investigate surrounding context in your own tooling.

This endpoint serves Linux Collector activity. macOS Collector telemetry is not yet available through the REST API.

List events

GET /v1/events

Parameter	Description
`host`	Host ID (comma-separate for multiple hosts)
`since` / `until`	Time window, RFC 3339. Default: the last 24 hours; maximum window 24 hours
`type`	`process`, `file`, or `network`
`limit`	Page size (default 50, max 200)
`cursor`	Continuation cursor from a previous response
`order`	`desc` (default, newest first) or `asc`

Only the parameters above are accepted; unknown parameters return 400.

curl "https://<your-dashboard-host>/v1/events" \
  -H "Authorization: Bearer $HILT_API_KEY" \
  -G --data-urlencode "host=web-prod-01" \
     --data-urlencode "type=network" \
     --data-urlencode "since=2026-07-07T12:00:00Z" \
     --data-urlencode "until=2026-07-07T13:00:00Z"

{
  "events": [
    {
      "event_type": "net_flow",
      "wall_time_ns": 1783428300123456789,
      "host_id": "web-prod-01",
      "pid": 48122,
      "tgid": 48122,
      "uid": 1000,
      "comm": "xfer",
      "parent_comm": "bash",
      "dst_addr": "203.0.113.9",
      "dst_port": 443,
      "protocol": 6,
      "bytes_sent": 48211230,
      "bytes_recv": 3120
    }
  ],
  "next_cursor": "eyJ3IjoxNzUxOD…"
}

Event categories

The type filter maps to these underlying event types (returned in each event’s event_type field):

`type`	Event types returned
`process`	`exec`
`file`	`file_open`, `file_unlink`, `file_rename`, `file_chmod`, `xattr_set`
`network`	`net_flow`

Process events carry comm, argv, parent_comm, and identity fields; file events add filename (and old_name/new_name for renames); network events carry the connection 5-tuple and byte counters.

Windows and volume

Event volume is high, so requests are bounded to a 24-hour window — walk longer ranges window by window. Without a host filter, results are capped at 20 events per host per page so a single busy host can’t drown out the fleet; filter to one host for exhaustive extraction.