Anonymized Data Export

Purpose

Hilt’s detection models improve when trained on diverse, real-world behavioral patterns. Anonymized data export is a core part of every Hilt deployment: a structured pipeline produces anonymized statistical summaries on a daily schedule, helping calibrate detection thresholds across different infrastructure types.

Dashboard view

Settings → System provides an export management panel:

Export picker — a dropdown to select an export by ID. Each export shows an icon indicating its status (approved or pending).
Manifest panel — once an export is selected, a detail panel displays:
- Date range
- Row count
- Host count
- Temporal jitter applied
- File size
- SHA-256 hash
- Column list
- Excluded columns note
- Zero-filled columns
- Status badges (anonymized, approved, transferred to Hilt)
Approve export — a button to approve the selected export, with a confirmation dialog.
Delete (reject) — a button to delete and reject the export, with a confirmation dialog.
Sample table — a preview showing the first 20 rows of the export data.

When no exports exist, an empty state reads: “Exports run on a daily schedule”. Permissions: viewing exports requires the view_audit permission; approving or deleting exports requires the manage_users permission.

What is exported

Data category	Description	Why it’s safe
Aggregate numeric features	Counts per 5-minute epoch (e.g., execution count, bytes transferred, unique destinations)	No raw values, only aggregate statistics
Derived statistical features	Ratios, entropies, and mathematical transforms of the aggregate counts	Pure algebra on aggregates
Abstracted activity tokens	Closed-vocabulary activity type sequences (no filenames, IPs, or commands)	All identifying information already removed at tokenization
Anomaly labels	Binary anomaly flags and scoring-phase labels	No customer-specific context
Temporal keys	5-minute bucket timestamps (jittered ±0–48h)	Calendar correlation prevented

What is never exported

Data	Why
File paths, command lines, arguments	Direct infrastructure/PII leakage
IP addresses, hostnames, DNS names	Network topology exposure
Usernames, SSH identities, Okta data	Identity leakage
Cloud resource IDs (instance, IAM role, region)	Account fingerprinting
Container/pod names and namespaces	Kubernetes topology
Detection rule names and match logic	Customer security posture
Free-text alert explanations	May echo sensitive event context
Dashboard accounts and sessions	Access credential exposure

Anonymization

Before export, all identifying information is stripped or remapped:

Host IDs → deterministic sequential remap (host-0001, host-0002, …)
User IDs → sequential integers per host
Owner/identity strings → dropped entirely
Timestamps → shifted by a random 0–48h offset to prevent calendar correlation
Minimum host threshold → exports with fewer than 5 hosts are rejected

Customer controls

Review before transfer

When approval is required (the default), the export produces a manifest and a small sample file. The full archive is staged but not transferred until you explicitly approve. You can:

Inspect the manifest to verify exactly which columns are included
Load the sample file to confirm anonymization
Reject by deleting the staged files from your storage bucket

Date range control

You control how much history to export and can limit to specific time windows.

Deletion

You can delete exported data from your storage bucket at any time.

Audit trail

Every export creates a logged event with the export ID, row count, date range, and approval status. The host ID mapping file stays exclusively in your bucket.

Operations reference

What Hilt receives

Behavioral feature vectors and abstracted activity sequences only. No filenames, IP addresses, hostnames, usernames, cloud resource IDs, detection rule names, or match descriptions.

Findings

Estate

Settings