> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Events

> Pull raw process, file, and network activity for a host and time window.

The events endpoint returns the raw activity stream behind a finding — every process execution, file operation, and network flow the Linux Collector recorded — so you can investigate surrounding context in your own tooling.

> [!NOTE]
>
> This endpoint serves Linux Collector activity. macOS Collector telemetry is not yet available through the REST API.

***

## List events

```text theme={null}
GET /v1/events
```

| Parameter | Description |
| - | - |
| `host` | Host ID (comma-separate for multiple hosts) |
| `since` / `until` | Time window, RFC 3339. Default: the last 24 hours; maximum window 24 hours |
| `type` | `process`, `file`, or `network` |
| `limit` | Page size (default 50, max 200) |
| `cursor` | Continuation cursor from a previous response |
| `order` | `desc` (default, newest first) or `asc` |

Only the parameters above are accepted; unknown parameters return `400`.

```bash theme={null}
curl "https://<your-dashboard-host>/v1/events" \
  -H "Authorization: Bearer $HILT_API_KEY" \
  -G --data-urlencode "host=web-prod-01" \
     --data-urlencode "type=network" \
     --data-urlencode "since=2026-07-07T12:00:00Z" \
     --data-urlencode "until=2026-07-07T13:00:00Z"
```

```json theme={null}
{
  "events": [
    {
      "event_type": "net_flow",
      "wall_time_ns": 1783428300123456789,
      "host_id": "web-prod-01",
      "pid": 48122,
      "tgid": 48122,
      "uid": 1000,
      "comm": "xfer",
      "parent_comm": "bash",
      "dst_addr": "203.0.113.9",
      "dst_port": 443,
      "protocol": 6,
      "bytes_sent": 48211230,
      "bytes_recv": 3120
    }
  ],
  "next_cursor": "eyJ3IjoxNzUxOD…"
}
```

## Event categories

The `type` filter maps to these underlying event types (returned in each event's `event_type` field):

| `type` | Event types returned |
| - | - |
| `process` | `exec` |
| `file` | `file_open`, `file_unlink`, `file_rename`, `file_chmod`, `xattr_set` |
| `network` | `net_flow` |

Process events carry `comm`, `argv`, `parent_comm`, and identity fields; file events add `filename` (and `old_name`/`new_name` for renames); network events carry the connection 5-tuple and byte counters.

## Windows and volume

Event volume is high, so requests are bounded to a 24-hour window — walk longer ranges window by window. Without a `host` filter, results are capped at 20 events per host per page so a single busy host can't drown out the fleet; filter to one host for exhaustive extraction.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.