Skip to main content
The Myrmex software agent — the program installed on a host — is built around a simple model: collect → enrich → respond. It gathers rich telemetry from the operating system, enriches and normalizes it, and streams it to the platform, where the AI agents decide what it means and what to do about it.
This page is about the software agent installed on a host. The AI agents (Perseus, Centurion, and the rest) are what interpret its telemetry and drive its response actions. It is not a standalone antivirus — the intelligence lives in the platform and its AI agents, not in a local signature engine.

​
Collect

The software agent observes the host across kernel and user space to build a complete picture of what’s happening:

Kernel-level activity

System calls and low-level interactions — file access, filesystem changes, permission changes — and network activity.

Processes

Process and thread creation, termination, and hierarchy, and the commands behind them.

Files & network

File and filesystem operations, network connections, and heavy DNS resolution.

System events & inventory

Windows Event Log (via ETW) and registry on Windows, audit and syslog on Linux, plus hardware and software inventory.
For the full breakdown of what the agent collects on each platform, see Agent capabilities.

​
Enrich

Before telemetry leaves the host, the agent normalizes and enriches it so it’s ready for analysis:
  • Normalization — events are mapped to the Myrmex event model, so data from Windows, Linux, and macOS is consistent.
  • Context — events are annotated with detail like source IP and the relationships between processes.
  • Classification — events are tagged so the platform and its AI agents can prioritize what matters.

​
Respond

The software agent doesn’t decide on its own what to do — it carries out response actions on the host when the AI agents direct it. Perseus, coordinated by Centurion, operates the agent to isolate a host, quarantine a file, kill a process, or run a remediation — always following the AI proposes, you approve pattern.
The agent also runs on-demand host-hardening audits that feed Security Posture, and applies approved OS updates through patch management.

​
Secure by Design

Everything the agent sends travels over a persistent, outbound-only encrypted connection. Data is protected with AES-256-GCM inside a TLS transport, and each device authenticates itself cryptographically. See Agent communication & security for the enrollment and transport details.

​
On-Host Files & Layout

Everything the agent keeps on disk lives under a few well-known locations. The paths below are for Linux; Windows and macOS store the equivalents in their platform-standard locations.
Two long-running services back the agent: myrmex-endpoint (the agent itself — collect / enrich / respond) and myrmex-supervisor, which keeps it running and applies the silent auto-updates.
Configuration — /etc/myrmex/
  • config.yml — the active configuration and the file that binds the host to a context. It holds the context_id, the agent_id, a derived secret (<context_id>_<agent_id>), and the platform endpoints it talks to: host / http_host / wss_host (the fleet channel) and check_host / download_host (updates). Root-only (0600).
  • env.conf — environment variables the service reads (ENVIRONMENT, HOST, CONTEXT, AGENT, and the *_HOST URLs). Root-only.
  • private_key.pem / public_key.pem — the agent’s RSA-4096 key pair, generated locally at enrollment. The private key never leaves the host (0600) and proves the agent’s identity; the public key is registered with the platform. These are the “certificates” created during registration — see Agent communication & security for the full handshake.
Logs — /var/log/myrmex/
  • mrx_rCURRENT.log — the current agent log (rotated to mrx_r000NN.log).
  • mrx_sup_rCURRENT.log — the supervisor log (rotated to mrx_sup_r000NN.log).
  • Sub-folders such as audit/ (host-hardening audit reports) and per-device backup folders produced by response / ops actions.
State — /var/lib/myrmex/
  • version_info.json — installed endpoint and supervisor versions, and the last update time.
  • quarantine/ — files placed in quarantine.
  • patch/ — patch-management working data.
  • endpoint_backups/ — previous binaries the supervisor can roll back to.
What registration writes. On install the agent generates the RSA key pair, registers with your installation token against the chosen context, receives its agent_id, and writes config.yml + env.conf binding it to that context. The full cryptographic exchange — token, key registration, signature challenge, AES session key, and rekeying — is covered in Agent communication & security.

​
Where to Go Next

Agent capabilities

The telemetry and response actions in detail.

Agent communication

Enrollment, cryptography, and transport.

Perseus

The AI agent that drives host response.

Collector mode

Run the same agent as a bridge to other systems.
Curious what a specific host is reporting? Open it in Device details or @-mention it in chat.