Skip to main content
Early access. Contact your account team to enable macOS endpoint deployment for your environment.
Hilt’s macOS endpoint coverage has two parts that work together:
  1. macOS collector — a notarized app with Apple Endpoint Security and NetworkExtension system extensions. This is the primary sensor for process, file, network, and persistence telemetry on the host.
  2. Managed Chromium browser extension — a force-installed extension on Chrome, Edge, and Brave that reports in-browser activity the kernel sensor cannot see (for example, file uploads into web-based AI services).
Together they extend Data Movement Governance to employee Macs, complementing the Linux collector on your server infrastructure. For system-extension architecture, MDM rollout, event schemas, and troubleshooting, see the macOS Collector guide. This page covers what to deploy and how the two pieces fit.

macOS collector (system extension)

The collector ships as Hilt EDR (EDRApp.app), embedding: Deploy via MDM for a zero-touch fleet rollout, or via the standalone .pkg for pilots. Both paths require a one-time (or MDM-pre-granted) system extension approval and Full Disk Access for ESensor. The collector runs with System Integrity Protection enabled — no kernel extension, no csrutil disable.

Managed Chromium browser extension

What it is for

The browser extension closes a visibility gap on macOS: many sensitive data movements happen inside the browser (uploading a file to a SaaS or AI web app) without a corresponding kernel-level file event Hilt can attribute. The extension observes selected browser activity and ships it to the same Hilt ingest path, correlated to the Mac by host_id (the same hardware UUID the macOS collector uses). In the dashboard, browser telemetry feeds views such as Activity (web-based file uploads) and AI-usage summaries. It does not replace the system collector — kernel telemetry and browser telemetry are complementary.

What it captures

The extension reports structured browser events (not page content or keystrokes). Event kinds include page navigation, heartbeats, file uploads, downloads, and network requests to configured destinations. Exact event types and fields evolve during early access; your account team can share the current schema for your deployment. Browser events land in a dedicated browser_events table, separate from kernel endpoint_events. They do not flow through the same scoring pipeline as Endpoint Security events.

How it is deployed

The extension is force-installed through your browser’s enterprise policy layer — the same mechanism IT teams use for managed Chrome/Edge extensions:
  • Chrome / Brave — ExtensionInstallForcelist (or equivalent) via Google Admin, Jamf, Kandji, Intune, or another MDM
  • Microsoft Edge — Edge management policy via Intune or Group Policy
Hilt provides the signed extension package (.crx or update URL) and the extension ID for your policy. Contact your account team to obtain the current build and a policy template for your MDM. The extension must be deployed alongside the macOS collector on each Mac. It posts to the same edr-collector ingest endpoint configured for the host forwarder.

Early-access caveats

The browser extension is early access and coverage is still expanding:
  • Chromium browsers only (Chrome, Edge, Brave) — no Safari or Firefox extension today
  • Requires the macOS collector and a deployment with browser enrichment enabled on the data plane
  • Event types and dashboard surfacing may change between releases
  • Force-install policy and extension packaging are coordinated with your account team, not self-service in the dashboard
If browser-based uploads or AI service usage are in scope for your deployment, confirm with your account team that browser enrichment is enabled before relying on Activity or AI-usage views.

Deployment checklist

Last modified on October 8, 2026