Skip to main content
The same software agent that monitors a host can instead run as a Collector: a lightweight real-time bridge between your integrations and the Myrmex cloud. It lets Myrmex reach systems that can’t run the agent themselves — network gear, cloud services, SaaS tools, databases, and other platforms — from inside your network.
It’s the same agent as in endpoint mode — only the role differs. Switch a device between Agent and Collector from its detail view, with no reinstall.
The Collector does not process or store anything. It runs the commands the platform sends it — on the local system or on a linked integration — and streams the results back in real time. There is no database and no data at rest: the Collector is a bridge, not a store.

​
How the Traffic Flows

The path is three parts, end to end — and the Collector initiates every connection outbound:

Integration — source

Network equipment, service accounts, internal APIs. The Collector reaches them over their native protocols (SSH, API). No inbound — the Collector starts the connection.

Collector — real-time bridge

A VM or physical machine on your network. It doesn’t process or store — it just runs the requested command on the local system or the linked integration.

Myrmex Cloud — destination

The SaaS platform. Receives events over outbound 443 and sends commands back for the Collector to run in real time over a persistent SSE channel.

​
Communication Architecture

The Collector talks to Myrmex outbound only, over TCP 443 (HTTPS + SSE). It opens every connection; nothing connects in to it.
SSL-inspecting proxies must bypass *.myrmex.ai. SSE cannot tolerate the connection break that TLS re-wrapping causes. The firewall/proxy must also allow long-lived sessions — don’t cut the outbound 443 connection to api.myrmex.ai / fleet.myrmex.ai on idle.
The SSE session must always egress from the same public IP. With SD-WAN, link balancers, or multiple uplinks, the Collector’s traffic must not switch route per packet or per session — changing the source IP mid-connection drops the persistent channels to api.myrmex.ai and fleet.myrmex.ai.

Option A — Source-destination IP (recommended)

On link balancers, pin by source IP + destination IP so the whole Collector → Myrmex session stays on one link.

Option B — Fixed preferred link

A policy route (PBR) that sends the Collector’s traffic to *.myrmex.ai out one specific link, failing over to a secondary only if it goes down.
Avoid per-packet round-robin, per-flow balancing without stickiness, and dynamic SD-WAN app-routing.

​
What a Collector Does Not Need

No inbound

No NAT, VIP, port-forward, public IP, or DNAT. The Collector starts every connection itself.

No processing

The platform doesn’t process anything on the Collector — it’s only a bridge.

No local storage

No integration data is persisted on the Collector. Nothing at rest — everything goes to the cloud in real time.

​
Collector Requirements

1 vCPU

Minimum. More vCPUs mean more parallelism for high-volume integrations.

1 GB RAM

Minimum. The Collector is light — there’s no heavy data cache.

10 GB disk

Minimum. Binaries, the agent’s own local logs, and dependencies.
Operating system: Ubuntu 24.04 (preferred — prioritized for testing and support), other Linux distributions (Debian, RHEL, Rocky, AlmaLinux), or Windows Server / 10 / 11 (installs as a system service). Where it runs: a virtual machine (VMware, Hyper-V, Proxmox, KVM, public cloud), a physical machine (dedicated hardware, mini-PC, appliance), or an existing workstation or server.

​
Install privileges & repository access

Installing requires top privilege so the agent can run requested commands without prompting the user:
  • Windows — install as a local Administrator; the agent runs as LocalSystem.
  • Linux — install as root (or with sudo); the agent runs as root.
During installation the machine downloads dependency packages, so allow outbound 443 to your OS’s official repositories, plus *.myrmex.ai:

​
Pre-install Checklist

1

Machine provisioned

A VM or physical machine — 1 vCPU · 1 GB RAM · 10 GB disk.
2

OS installed and updated

Ubuntu 24.04 preferred.
3

Administrative account

root on Linux · Administrator on Windows.
4

Outbound 443 open

api.myrmex.ai + fleet.myrmex.ai + your OS repositories.
5

TLS bypass configured

On SSL-inspecting proxies, if you have them.
6

Link balancing handled

Source-destination IP stickiness, or a fixed preferred link.

​
What You Can Connect

A Collector brings in sources that have no agent of their own — cloud providers, firewalls and network devices, SIEMs, other EDR/XDR platforms, databases, ITSM, and more. Browse the full catalog and setup guides in Integrations.
A device configured as a Collector shows the integrations connected through it in its detail view.

Endpoint mode

Run the agent as a monitored host instead.

Deploying the agent

Install the agent, then set its role from the device detail view.