In file paths, service names, and environment variables you may see the prefix
dag (e.g. dag-agent, DAG_SHIP_URL). This is the internal codename of Hilt’s telemetry engine and is functionally equivalent to “Hilt Collector” throughout this documentation.docs/client-deployment-guide.md (and is uploaded as README.md per version); this guide is the long-form companion.
What is a collector
The collector is a single static Linux binary (~5 MB, zero dependencies) plus an eBPF program that the binary loads into the kernel at startup. It attaches tracepoints to a narrow set of kernel entry points, derives an identity-aware event stream from them, filters out high-volume noise in userspace, and ships the results to your Hilt ingest endpoint. The program attaches to syscalls and kernel hooks to capture process execution, file operations, and network events.What the collector does not do
The DMG Collector is strictly observational. It does not:- Expose network services. The agent only makes outbound HTTPS to your control plane defined as
DAG_SHIP_URL. Nothing else opens a socket. - Install kernel modules. Everything rides eBPF (CO-RE with native or bundled BTF, depending on kernel version); there is no out-of-tree driver, no DKMS, no custom kernel build.
- Modify network traffic. The agent observes; it never injects, drops, blocks, or alters packets. Quarantine (where used) is a separate control-plane action via AWS security groups, executed by the dashboard, not by the agent.
- Change host state. No system modifications are made, aside from optionally writing a configuration file.
- Perform external callbacks. No license checks, telemetry beacons, or “phone-home” behavior. The only outbound communication is the configured event stream.