# Hilt Documentation

> Deploy, configure, and operate Hilt: Data Movement Governance for modern infrastructure.

## Getting Started

- [Getting Started](https://hilt.ai/docs/getting-started.md): What happens between signing your contract and seeing your first findings: who does what, the deployment timeline, and the platform warm-up period.

### Deployment

#### Cloud

- [VPC Setup Guide](https://hilt.ai/docs/deployment/client-vpc-setup.md): Connect your workload VPCs to Hilt so collectors can send telemetry and your team can access the dashboard.
- [AWS](https://hilt.ai/docs/deployment/aws.md): Hilt's single-tenant deployment architecture and provisioning on AWS.
- [GCP](https://hilt.ai/docs/deployment/gcp.md): Hilt's single-tenant deployment architecture and provisioning on GCP.
- [Azure](https://hilt.ai/docs/deployment/azure.md): Hilt's single-tenant deployment architecture and provisioning on Azure.
- [Ali Cloud](https://hilt.ai/docs/deployment/ali-cloud.md): Hilt's single-tenant deployment architecture and provisioning on Ali Cloud.

#### Endpoints

- [macOS](https://hilt.ai/docs/deployment/macos.md): Deploy Hilt on macOS endpoints: the system collector and managed Chromium browser extension.

## Platform

- [Dashboard layout](https://hilt.ai/docs/dashboard/layout.md): How the Hilt console is organized: finding queues, estate, Ask, and Settings.
- [Overview](https://hilt.ai/docs/dashboard/overview.md): The Hilt home dashboard: editable widgets for fleet health, findings, and threat profile.

### Findings

- [Anomalies](https://hilt.ai/docs/dashboard/anomalies.md): Model-flagged behavioral findings, and the sensitive paths, users, and hosts they are weighted against.
- [Sensitivity list](https://hilt.ai/docs/dashboard/sensitivity-list.md): Mark the files, destinations, people, and hosts that matter to you, so their findings surface sooner and carry more weight.
- [Alerts](https://hilt.ai/docs/dashboard/alerts.md): Findings a custom detection rule matched, and the alert-rule library that produces them.
- [Exfiltration](https://hilt.ai/docs/dashboard/exfiltration.md): Data-movement findings, exfil detection rules, and the egress activity ledger.
- [Exposure](https://hilt.ai/docs/dashboard/exposure.md): Third-party dependency findings and the full dependency landscape.
- [Malware](https://hilt.ai/docs/dashboard/malware.md): Malware findings, malware detection rules, and per-endpoint malware status.

### Estate

- [Collectors](https://hilt.ai/docs/dashboard/collectors.md): Host and group roster. Open a collector for Files, Networks, Processes, Credentials, and containment.
- [People](https://hilt.ai/docs/dashboard/people.md): Identity roster across the estate. Open a person for Files, Networks, Processes, Browser, and Credentials.
- [Networks](https://hilt.ai/docs/dashboard/networks.md): Linux fleet network flows — destinations, volume, and topology.
- [Health](https://hilt.ai/docs/dashboard/health.md): Application and browser-service failures across the fleet — crashes, OOM, hangs, and HTTP errors.
- [Logs](https://hilt.ai/docs/dashboard/logs.md): Event search and data lineage — what happened, and what led to it.

### Settings

#### Account

- [Account](https://hilt.ai/docs/dashboard/settings-account.md): Account profile: username, password, sessions, sign-in history, and API keys.

#### Uptime

- [System Status](https://hilt.ai/docs/administration/system-status.md): Live health monitoring of the services behind your Hilt dashboard.
- [Prometheus metrics](https://hilt.ai/docs/administration/prometheus.md): Scrape process and runtime telemetry from Hilt platform services with Prometheus or any compatible agent.

#### System

- [Model Lifecycle](https://hilt.ai/docs/on-prem/model-lifecycle.md): Managing the TRACE detection model: status, updates, promotion, and rollback.
- [Auto-Update Overview](https://hilt.ai/docs/on-prem/auto-update-overview.md): Overview of the auto-update agent and its version policy.
- [Prerequisites](https://hilt.ai/docs/on-prem/auto-update-prerequisites.md): IAM roles and access requirements for the auto-update agent.
- [Update Workflow](https://hilt.ai/docs/on-prem/auto-update-workflow.md): Step-by-step update flow and rollback procedures for the auto-update agent.
- [Operational Guide](https://hilt.ai/docs/on-prem/auto-update-operations.md): Network requirements, monitoring, security, and enabling or disabling the auto-update agent.
- [Anonymized Data Export](https://hilt.ai/docs/on-prem/data-export-overview.md): How telemetry is anonymized for Hilt model improvement while preserving privacy.
- [Data Catalog](https://hilt.ai/docs/on-prem/data-catalog.md): Categories of data stored by the platform and what each category contains.
- [Export Schema](https://hilt.ai/docs/on-prem/data-export-schema.md): Schema of the anonymized Parquet export file.
- [Running Exports](https://hilt.ai/docs/on-prem/data-export-implementation.md): Anonymization rules, running the export pipeline, and customer controls.
- [Fleet behavior](https://hilt.ai/docs/dashboard/fleet-behavior.md): Cluster analysis and behavioral modeling across your host fleet.

#### Teams

- [Teams](https://hilt.ai/docs/administration/teams.md): Creating teams and scoping collector visibility by team membership.
- [User Management](https://hilt.ai/docs/administration/user-management.md): Inviting, managing, and removing dashboard users.
- [Identity Mapping](https://hilt.ai/docs/administration/identity-mappings.md): Grouping the many identities one person uses into a single person record.

#### Integrations

- [Slack notifications](https://hilt.ai/docs/administration/slack-notifications.md): Set up Slack incoming webhooks so Hilt posts anomaly alerts to your workspace.
- [Google Workspace](https://hilt.ai/docs/administration/google-workspace.md): Connect Google Workspace Directory so Hilt can measure install coverage against your employee roster.
- [AWS accounts (Cloud Connect)](https://hilt.ai/docs/administration/aws-cloud-accounts.md): Connect your AWS organization so Hilt can inventory EC2 instances, install the Linux agent, and network-quarantine a compromised host.
- [AWS IAM roles](https://hilt.ai/docs/administration/aws-iam-roles.md): Exactly which IAM roles Hilt asks you to create, what each one can do, and who needs what to deploy them.
- [Webhooks](https://hilt.ai/docs/administration/webhooks.md): Configure outbound webhooks from Settings → Integrations.

#### Reports

- [Reports](https://hilt.ai/docs/administration/reports.md): Generating and exporting security reports from Hilt findings.

#### Admin

- [Enterprise domains](https://hilt.ai/docs/administration/enterprise-domains.md): What counts as an enterprise AI account: company email domains and exact provider identity bindings.
- [Cloud Sources](https://hilt.ai/docs/administration/cloud-sources.md): Label the fleets available in the top-bar data source selector.
- [Billing](https://hilt.ai/docs/administration/billing.md): Subscription, collector usage, and invoice history in the Hilt console.
- [LLM Cost](https://hilt.ai/docs/administration/llm-cost.md): Token usage and spend across every Hilt service that calls a model.
- [Storage](https://hilt.ai/docs/administration/storage.md): Monitoring telemetry storage usage across tiers.
- [Audit Log](https://hilt.ai/docs/administration/audit-log.md): Reviewing authentication and administrative actions grouped by user session.

## API Reference

- [API Overview & Authentication](https://hilt.ai/docs/api/overview.md): Authenticate to the REST API with bearer API keys and understand scoping, errors, and pagination.
- [Findings](https://hilt.ai/docs/api/findings.md): List, inspect, and review (accept or deny) findings via the REST API.
- [Events](https://hilt.ai/docs/api/events.md): Pull raw process, file, and network activity for a host and time window.
- [Hosts](https://hilt.ai/docs/api/hosts.md): List monitored hosts and their live status.
- [Detection Rules](https://hilt.ai/docs/api/detection-rules.md): List your custom detection rules and how often each has fired.
- [Webhooks](https://hilt.ai/docs/api/webhooks.md): Receive signed HTTP POSTs when findings are created or reviewed and when detection rules fire.
- [SIEM & SOAR integration](https://hilt.ai/docs/api/siem.md): Integrate Hilt with your SIEM or SOAR using the REST API and signed webhooks.
- [Worked Example: Triage from Your Terminal](https://hilt.ai/docs/api/worked-example.md): Pull today's critical findings, inspect one, and push a review decision back — end to end.
- [Query](https://hilt.ai/docs/dashboard/query.md): Natural-language assistant over telemetry and Hilt documentation.
- [MCP server](https://hilt.ai/docs/dashboard/mcp-server.md): Connect AI assistants to Hilt telemetry with the MCP server.
- [ClickHouse Tables](https://hilt.ai/docs/administration/clickhouse-tables.md): A reference map of the ClickHouse tables behind the platform: what each one holds, what writes to it, what reads from it, and its default retention.

## Linux Collector

- [Linux Collector](https://hilt.ai/docs/linux-collector/layout.md): What the Hilt DMG Collector is, what it observes, and how to navigate this guide.
- [System requirements](https://hilt.ai/docs/linux-collector/system-requirements.md): Kernel, architecture, privileges, network, and resource requirements for the DMG Collector.
- [Release artifacts](https://hilt.ai/docs/linux-collector/release-artifacts.md): Tarball layout, container image, and the offline bundle for airgapped environments.
- [Deploy on Kubernetes](https://hilt.ai/docs/linux-collector/deploy-kubernetes.md): Deploy the DMG Collector as a DaemonSet, including RBAC, runtime config, host mounts, install, upgrade, and uninstall.
- [Deploy on VMs](https://hilt.ai/docs/linux-collector/deploy-vms.md): Install the Hilt Collector on bare EC2 or on-prem Linux via systemd, including interactive and automated installs.
- [Deploy on ECS Fargate](https://hilt.ai/docs/linux-collector/deploy-fargate.md): Deploy the Hilt Collector into AWS ECS Fargate tasks via an installer sidecar and entrypoint wrapper — no image rebuild required.
- [Deploy on Kata Containers](https://hilt.ai/docs/linux-collector/deploy-kata.md): Deploy the Hilt Collector into VM-isolated Kubernetes pods (Kata Containers) automatically with an admission webhook, or by patching pod templates — no image rebuild required.
- [Configuration reference](https://hilt.ai/docs/linux-collector/configuration.md): CLI flags, environment variables, and config file keys for the DMG Collector.
- [Networking and security](https://hilt.ai/docs/linux-collector/networking-security.md): Outbound network posture, airgapped operation, privilege model, and data residency.
- [Event data model](https://hilt.ai/docs/linux-collector/event-data-model.md): What the collector captures, and explicitly what it does not.
- [Agent filtering](https://hilt.ai/docs/linux-collector/agent-filtering.md): How the collector reduces raw syscall volume to a security-relevant event stream.
- [Sizing and capacity](https://hilt.ai/docs/linux-collector/sizing-capacity.md): Measured resource usage by host type, default limits, and ring buffer tuning.
- [End-to-end data flow](https://hilt.ai/docs/linux-collector/data-flow.md): How events travel from the collector to the dashboard.
- [Troubleshooting](https://hilt.ai/docs/linux-collector/troubleshooting.md): Common DMG Collector failures and how to resolve them.

## macOS Collector

- [macOS Collector](https://hilt.ai/docs/macos-collector/layout.md): What the Hilt macOS Collector is, what it observes, and how to navigate this guide.
- [System requirements](https://hilt.ai/docs/macos-collector/system-requirements.md): macOS version, architecture, System Integrity Protection, Full Disk Access, MDM, and network requirements for the Hilt macOS Collector.
- [Release artifacts](https://hilt.ai/docs/macos-collector/release-artifacts.md): What ships in a macOS release: a notarized, Developer ID-signed .pkg embedding EDRApp.app (ESensor + NetFilter) and the forwarder, with code-signing, notarization, and Hardened Runtime details plus how to verify a build.
- [Install Flow (Standalone)](https://hilt.ai/docs/macos-collector/install-flow.md): Install the Hilt macOS Collector from the notarized .pkg: extension approval and Full Disk Access, end to end, with System Integrity Protection left enabled.
- [Deploy standalone (direct download)](https://hilt.ai/docs/macos-collector/deploy-standalone.md): Install the Hilt macOS Collector on a single Mac or small team with the notarized .pkg, no MDM: double-click install, one-time approve + Full Disk Access, and verification.
- [Deploy via MDM](https://hilt.ai/docs/macos-collector/deploy-mdm.md): Zero-click fleet rollout of the Hilt macOS Collector through Jamf, Kandji, Intune, or any MDM that accepts a custom profile: push the signed .pkg, then upload one generated profile (or build the payloads by hand) to auto-approve the System Extension and pre-grant Full Disk Access, with no end-user i…
- [Uninstall (standalone)](https://hilt.ai/docs/macos-collector/uninstall.md): Remove the Hilt macOS Collector from a Mac that was installed standalone: turn off its security extensions, restart, then remove the app, its forwarder service, and support files.
- [Configuration reference](https://hilt.ai/docs/macos-collector/configuration.md): Environment variables, on-disk paths, host identity, and MDM-delivered configuration for the Hilt macOS Collector.
- [Networking and trust model](https://hilt.ai/docs/macos-collector/networking-security.md): Outbound HTTPS posture, the Apple trust chain (Developer ID, notarization, Hardened Runtime, the ES entitlement, SIP), the two runtime gates, and System Extension tamper-resistance.
- [Event data model](https://hilt.ai/docs/macos-collector/event-data-model.md): The endpoint_events schema: what the macOS collector captures, the code-signing trust and application attribution stamped on every row, and explicitly what it does not capture.
- [Event coverage and filtering](https://hilt.ai/docs/macos-collector/event-coverage.md): Which Apple Endpoint Security events the macOS collector captures, how each one maps to a typed event, and how userspace filtering reduces file-open volume to a security-relevant stream.
- [Sizing and capacity](https://hilt.ai/docs/macos-collector/sizing-capacity.md): Per-endpoint event rates, System Extension CPU/memory footprint, compressed HTTPS bandwidth, and how the collector tier scales with macOS host count. Early-access figures.
- [End-to-end data flow](https://hilt.ai/docs/macos-collector/data-flow.md): How a macOS endpoint event travels from the ESensor system extension, through the local forwarder and edge collector, into MSK and enrichment, and onto ClickHouse and the dashboard.
- [Troubleshooting](https://hilt.ai/docs/macos-collector/troubleshooting.md): Diagnose and fix common Hilt macOS Collector failures: system extension approval, Endpoint Security entitlement and Full Disk Access errors, and telemetry that never lands.

### Detections

- [On-device detections & response](https://hilt.ai/docs/macos-collector/detections.md): On-device detection engine in the macOS collector: rule families, grading, and in-kernel response.
- [Persistence](https://hilt.ai/docs/macos-collector/detections/persistence.md): Everything that installs itself to survive a reboot on macOS — launch agents, daemons, and login items — caught at registration by Background Task Management, with the installing process's code-signing verdict driving severity.
- [Tamper Detection](https://hilt.ai/docs/macos-collector/detections/tamper.md): Attempts to weaken macOS security controls — Gatekeeper quarantine removal, configuration-profile changes, and attacks on the Hilt agent itself, which the sensor denies in-kernel and surfaces as blocked findings.

## Trust & Security

- [Trust & Security](https://hilt.ai/docs/trust-security.md): Hilt's trust model: customer-owned single-tenant deployment, least-privilege access, transparent data handling, and defense in depth.
- [Architecture & data flow](https://hilt.ai/docs/trust-security/architecture.md): Hilt's single-tenant deployment model, component map, per-cloud services, network boundaries, and end-to-end data flow.
- [Data collection & handling](https://hilt.ai/docs/trust-security/data-handling.md): What Hilt collectors capture, what they never capture, how events are filtered, where data lives, and retention.
- [Access & identity](https://hilt.ai/docs/trust-security/access-control.md): Dashboard authentication, role-based access, team scoping, audit logging, and the approval-gated Hilt engineer access model.
- [Encryption & key management](https://hilt.ai/docs/trust-security/encryption.md): How Hilt encrypts data in transit and at rest, how certificates are handled, and who holds the keys.
- [Security operations](https://hilt.ai/docs/trust-security/operations.md): Software supply chain, patching and updates, platform monitoring, backups, logging, and change management for Hilt.
- [Compliance & legal](https://hilt.ai/docs/trust-security/compliance.md): How Hilt's deployment model shapes data residency, processing roles, privacy, certifications, and subprocessors.
- [Incident response & vulnerability disclosure](https://hilt.ai/docs/trust-security/incident-response.md): How to report a security incident or a vulnerability to Hilt, and what to expect in response.

> The links below point to documentation indexes. Follow each `/_llms/` index recursively until you reach documentation pages.

## Indexes

- [Chinese (95 pages)](https://hilt.ai/docs/_llms/zh.txt): 快速入门, 平台, API 参考, Linux 采集器, macOS 采集器, 信任与安全.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.