> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Catalog

> Categories of data stored by the platform and what each category contains.

This page describes the categories of data the Hilt platform stores about your environment. It is organized by what each data category represents, not by internal storage details.

***

## Event telemetry

The primary data the platform collects from your hosts. Each record represents one observed system event.

| Category | What it contains |
| :- | :- |
| **Process execution** | Command name, parent process, PID, user ID, timestamps, command-line arguments |
| **File operations** | File path accessed, operation type (open, rename, delete, permission change), user and process context |
| **Network flows** | Source/destination IP and port, protocol, bytes sent/received, connection scope (internal/external) |
| **Host identity** | Host ID, hostname, cloud region, instance ID, cluster membership |
| **User identity** | OS username, resolved owner identity, SSH identity, identity source and confidence |
| **Container/Kubernetes context** | Container ID, pod name/namespace, workload controller, cgroup information |
| **Workload & application identity** | Logical workload grouping, application name, application kind |

***

## Anomaly detection

Data produced by the detection and scoring pipeline.

| Category | What it contains |
| :- | :- |
| **Anomaly scores** | Per-epoch numerical scores across detection channels, anomaly flags, scoring phase |
| **Alert narratives** | AI-generated explanations of findings: what happened, why it's unusual, affected identities |
| **Behavior clusters** | Fleet-wide behavioral groupings with labels, host membership, and movement history |
| **Detection rule matches** | Rule name, severity, matched conditions, affected host and time window |

***

## Human review

Data produced by your team's triage activity.

| Category | What it contains |
| :- | :- |
| **Review verdicts** | Finding ID, verdict (confirmed/dismissed), reviewer, confidence, notes |
| **Feedback events** | Verdicts fed back to detection models to suppress known-good patterns |

***

## Dashboard & access

Data used by the web dashboard.

| Category | What it contains |
| :- | :- |
| **User accounts** | Dashboard login credentials (hashed), roles, team membership |
| **Teams** | Team hierarchy, host assignments per team |
| **Sessions** | Active login sessions |
| **Audit log** | Administrative actions taken by dashboard users |
| **Host records** | Display names, quarantine state, tags, network prefix inventory |
| **Identity directory** | Cached Okta/IdP directory for identity resolution |

***

## Hourly rollups

Pre-aggregated counters used for dashboard performance. These contain per-host, per-hour event counts: no raw event details.

***

## Data retention

Retention policies are configurable per deployment. Contact your account team for your current settings and available options.

***

## What Hilt cannot see

The collector does not capture file contents, packet payloads, environment variables, memory contents, or keystrokes. The platform stores metadata about system activity rather than the data itself.

**One exception, on macOS:** the clipboard sensor is on by default and stores copied content. Raw content is readable only by a global administrator, is truncated, and expires after 30 days instead of the usual 90. It can be reduced to metadata-only or disabled by managed preference — see [Clipboard and data movement](https://hilt.ai/docs/macos-collector/layout.md#clipboard-and-data-movement).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.