Data Catalog

This page describes the categories of data the Hilt platform stores about your environment. It is organized by what each data category represents, not by internal storage details.

Event telemetry

The primary data the platform collects from your hosts. Each record represents one observed system event.

Category	What it contains
Process execution	Command name, parent process, PID, user ID, timestamps, command-line arguments
File operations	File path accessed, operation type (open, rename, delete, permission change), user and process context
Network flows	Source/destination IP and port, protocol, bytes sent/received, connection scope (internal/external)
Host identity	Host ID, hostname, cloud region, instance ID, cluster membership
User identity	OS username, resolved owner identity, SSH identity, identity source and confidence
Container/Kubernetes context	Container ID, pod name/namespace, workload controller, cgroup information
Workload & application identity	Logical workload grouping, application name, application kind

Anomaly detection

Data produced by the detection and scoring pipeline.

Category	What it contains
Anomaly scores	Per-epoch numerical scores across detection channels, anomaly flags, scoring phase
Alert narratives	AI-generated explanations of findings: what happened, why it’s unusual, affected identities
Behavior clusters	Fleet-wide behavioral groupings with labels, host membership, and movement history
Detection rule matches	Rule name, severity, matched conditions, affected host and time window

Human review

Data produced by your team’s triage activity.

Category	What it contains
Review verdicts	Finding ID, verdict (confirmed/dismissed), reviewer, confidence, notes
Feedback events	Verdicts fed back to detection models to suppress known-good patterns

Dashboard & access

Data used by the web dashboard.

Category	What it contains
User accounts	Dashboard login credentials (hashed), roles, team membership
Teams	Team hierarchy, host assignments per team
Sessions	Active login sessions
Audit log	Administrative actions taken by dashboard users
Host records	Display names, quarantine state, tags, network prefix inventory
Identity directory	Cached Okta/IdP directory for identity resolution

Hourly rollups

Pre-aggregated counters used for dashboard performance. These contain per-host, per-hour event counts: no raw event details.

Data retention

Retention policies are configurable per deployment. Contact your account team for your current settings and available options.

What Hilt cannot see

The collector does not capture file contents, packet payloads, environment variables, memory contents, or keystrokes. The platform stores metadata about system activity rather than the data itself. One exception, on macOS: the clipboard sensor is on by default and stores copied content. Raw content is readable only by a global administrator, is truncated, and expires after 30 days instead of the usual 90. It can be reduced to metadata-only or disabled by managed preference — see Clipboard and data movement.

Findings

Estate

Settings