> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# On-device detections & response

> On-device detection engine in the macOS collector: rule families, grading, and in-kernel response.

The macOS collector embeds an on-device detection engine that evaluates kernel events as they happen. This section describes what that engine looks for and how findings reach the console.

For raw telemetry, see [Event coverage](https://hilt.ai/docs/macos-collector/event-coverage.md). For console hubs that display related activity, see [Malware](https://hilt.ai/docs/dashboard/malware.md), [Collectors](https://hilt.ai/docs/dashboard/collectors.md) (Credentials / Files tabs), [Networks](https://hilt.ai/docs/dashboard/networks.md), and [Overview](https://hilt.ai/docs/dashboard/overview.md).

***

## Where detection happens

Detection runs **on the endpoint, inside ESensor**, before events leave the Mac. Because the engine sits on Apple's Endpoint Security AUTH path, it can **deny an operation in-kernel** rather than only report it afterward. Every evaluated event carries code-signing trust and application attribution — rules grade *who is acting*, not only *what happened*.

***

## Rule families

| Family | What it watches | Where to read more |
| - | - | - |
| **Tamper** | Gatekeeper quarantine removal, profile changes, attacks on the agent | [Tamper](https://hilt.ai/docs/macos-collector/detections/tamper.md) |
| **Persistence** | Launch agents, daemons, login items | [Persistence](https://hilt.ai/docs/macos-collector/detections/persistence.md) |
| **Credential & privacy** | Keychain, browser stores, TCC, camera/mic | [Credentials](https://hilt.ai/docs/dashboard/credentials.md) |
| **Data movement** | Removable media writes, unusual egress | [Files](https://hilt.ai/docs/dashboard/files.md), [Networks](https://hilt.ai/docs/dashboard/networks.md) |

***

## How the agent responds

| Status | Meaning |
| - | - |
| `blocked` | Denied in-kernel (e.g. agent self-protection, clear Gatekeeper tamper) |
| `alerted` | Operation completed; elevated finding for review |
| `logged` | Recorded for context and correlation |

Severity scales with the actor's code-signing verdict. The collector protects its own app bundle and extensions — unauthorized kill/delete/rename attempts are denied in-kernel and surfaced as blocked tamper findings. Authorized MDM removal paths remain allowed; see [Uninstall](https://hilt.ai/docs/macos-collector/uninstall.md).

***

## Shared finding layout

Findings typically include: **What happened · Process responsible · What was touched · Why it matters · Evidence · Recommended action**, plus severity/status and the responsible app's trust verdict.

***

## Kernel foundation (why macOS rows look different)

Every Endpoint Security event can carry:

* **Code-signing identity** — platform, Developer ID, ad hoc, unsigned/invalid
* **Application attribution** — owning app, not only `comm`

That is why persistence and tamper severity can be driven by *who* acted. Details: [Event data model](https://hilt.ai/docs/macos-collector/event-data-model.md).

***

## From finding to dashboard

Findings use the same authenticated ingest path as telemetry. Triage them in [Malware](https://hilt.ai/docs/dashboard/malware.md) and deep-dive evidence in [Logs](https://hilt.ai/docs/dashboard/logs.md) (macOS scope).

> [!NOTE]
>
> Detection rules ship with the collector and are versioned. The policy version on agent headers records which rule set a Mac is running.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.