> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Event data model

> What the collector captures, and explicitly what it does not.

Each event captures execution and system metadata, including:

* Timestamps
* Process and user identifiers (PID / UID)
* Command name, binary path, and arguments
* File paths (for file events)
* Network details such as the 5-tuple and byte counts (for network events)
* Container and cgroup identifiers
* The configured node label

This allows activity to be correlated across hosts and workloads.

## What the collector does not capture

The collector does **not** capture sensitive content by default. This includes:

* File contents
* Packet payloads
* Memory regions
* Environment variables
* Process memory
* Credentials
* Any user data beyond what standard system tools like `ps`, `lsof`, or `ss` would expose

In other words, the agent observes system activity at the metadata level only unless you opt a host into [content inspection](https://hilt.ai/docs/trust-security/data-handling.md#content-inspection) (`DAG_CONTENT_INSPECT`). When that is enabled, the source file of a `DATA_FLOW` to a public destination may be copied (100 MiB cap, 30-day retention, global-admin view) into in-tenant object storage. Packet payloads and memory are still never captured.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.