> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Collector Mode

> Run the Myrmex agent as a Collector — a real-time bridge between your integrations and the Myrmex cloud. Outbound-only, no data at rest.

import { CardGroup, Card, Note, Warning, Steps, Step, Tip } from '@mintlify/components';

The same software agent that monitors a host can instead run as a **Collector**: a lightweight **real-time bridge** between your integrations and the Myrmex cloud. It lets Myrmex reach systems that can't run the agent themselves — network gear, cloud services, SaaS tools, databases, and other platforms — from inside your network.

<Note>
  It's the same agent as in
  [endpoint mode](/documentation/agent-endpoint-security/endpoint-mode) — only
  the **role** differs. Switch a device between **Agent** and **Collector** from
  its [detail view](/documentation/agent-endpoint-security/device-details), with
  no reinstall.
</Note>

The Collector **does not process or store anything**. It runs the commands the platform sends it — on the local system or on a linked integration — and streams the results back in real time. There is no database and no data at rest: the Collector is a bridge, not a store.

## How the Traffic Flows

The path is three parts, end to end — and the Collector **initiates every connection outbound**:

<CardGroup cols={3}>
  <Card title="Integration — source" icon="plug">
    Network equipment, service accounts, internal APIs. The Collector reaches
    them over their native protocols (SSH, API). No inbound — the Collector
    starts the connection.
  </Card>

  <Card title="Collector — real-time bridge" icon="server">
    A VM or physical machine on your network. It doesn't process or store — it
    just runs the requested command on the local system or the linked
    integration.
  </Card>

  <Card title="Myrmex Cloud — destination" icon="cloud">
    The SaaS platform. Receives events over outbound 443 and sends commands back
    for the Collector to run in real time over a persistent SSE channel.
  </Card>
</CardGroup>

## Communication Architecture

The Collector talks to Myrmex **outbound only, over TCP 443 (HTTPS + SSE)**. It opens every connection; nothing connects in to it.

| Destination       | Port | Protocol    | Purpose                                             |
| ----------------- | ---- | ----------- | --------------------------------------------------- |
| `*.myrmex.ai`     | 443  | HTTPS + SSE | Wildcard (preferred) — covers your whole fleet      |
| `api.myrmex.ai`   | 443  | HTTPS + SSE | REST API, authentication, and the SSE event channel |
| `fleet.myrmex.ai` | 443  | HTTPS + SSE | Persistent SSE channel for real-time commands       |

<Warning>
  **SSL-inspecting proxies must bypass `*.myrmex.ai`.** SSE cannot tolerate the
  connection break that TLS re-wrapping causes. The firewall/proxy must also
  allow **long-lived sessions** — don't cut the outbound 443 connection to
  `api.myrmex.ai` / `fleet.myrmex.ai` on idle.
</Warning>

### Multiple outbound links

The SSE session must always egress from the **same public IP**. With SD-WAN, link balancers, or multiple uplinks, the Collector's traffic **must not** switch route per packet or per session — changing the source IP mid-connection drops the persistent channels to `api.myrmex.ai` and `fleet.myrmex.ai`.

<CardGroup cols={2}>
  <Card title="Option A — Source-destination IP (recommended)" icon="arrows-left-right">
    On link balancers, pin by **source IP + destination IP** so the whole
    Collector → Myrmex session stays on one link.
  </Card>

  <Card title="Option B — Fixed preferred link" icon="route">
    A policy route (PBR) that sends the Collector's traffic to `*.myrmex.ai` out
    one specific link, failing over to a secondary only if it goes down.
  </Card>
</CardGroup>

Avoid per-packet round-robin, per-flow balancing without stickiness, and dynamic SD-WAN app-routing.

## What a Collector Does *Not* Need

<CardGroup cols={3}>
  <Card title="No inbound" icon="shield-halved">
    No NAT, VIP, port-forward, public IP, or DNAT. The Collector starts every
    connection itself.
  </Card>

  <Card title="No processing" icon="microchip">
    The platform doesn't process anything on the Collector — it's only a bridge.
  </Card>

  <Card title="No local storage" icon="database">
    No integration data is persisted on the Collector. Nothing at rest —
    everything goes to the cloud in real time.
  </Card>
</CardGroup>

## Collector Requirements

<CardGroup cols={3}>
  <Card title="1 vCPU" icon="microchip">
    Minimum. More vCPUs mean more parallelism for high-volume integrations.
  </Card>

  <Card title="1 GB RAM" icon="memory">
    Minimum. The Collector is light — there's no heavy data cache.
  </Card>

  <Card title="10 GB disk" icon="hard-drive">
    Minimum. Binaries, the agent's own local logs, and dependencies.
  </Card>
</CardGroup>

**Operating system:** **Ubuntu 24.04** (preferred — prioritized for testing and support), other Linux distributions (Debian, RHEL, Rocky, AlmaLinux), or **Windows Server / 10 / 11** (installs as a system service).

**Where it runs:** a virtual machine (VMware, Hyper-V, Proxmox, KVM, public cloud), a physical machine (dedicated hardware, mini-PC, appliance), or an existing workstation or server.

### Install privileges & repository access

Installing requires top privilege so the agent can run requested commands without prompting the user:

* **Windows** — install as a **local Administrator**; the agent runs as **LocalSystem**.
* **Linux** — install as **root** (or with `sudo`); the agent runs as **root**.

During installation the machine downloads dependency packages, so allow outbound **443** to your OS's official repositories, plus `*.myrmex.ai`:

| Operating system    | Repository                                 |
| ------------------- | ------------------------------------------ |
| Ubuntu / Debian     | `archive.ubuntu.com`                       |
| RHEL / Rocky / Alma | `mirrors.rockylinux.org`                   |
| Windows             | `download.microsoft.com`                   |
| All                 | `*.myrmex.ai` (agent binaries & installer) |

## Pre-install Checklist

<Steps>
  <Step title="Machine provisioned">A VM or physical machine — 1 vCPU · 1 GB RAM · 10 GB disk.</Step>
  <Step title="OS installed and updated">Ubuntu 24.04 preferred.</Step>
  <Step title="Administrative account">root on Linux · Administrator on Windows.</Step>
  <Step title="Outbound 443 open">`api.myrmex.ai` + `fleet.myrmex.ai` + your OS repositories.</Step>
  <Step title="TLS bypass configured">On SSL-inspecting proxies, if you have them.</Step>
  <Step title="Link balancing handled">Source-destination IP stickiness, or a fixed preferred link.</Step>
</Steps>

## What You Can Connect

A Collector brings in sources that have no agent of their own — cloud providers, firewalls and network devices, SIEMs, other EDR/XDR platforms, databases, ITSM, and more. Browse the full catalog and setup guides in [Integrations](/documentation/integrations/overview).

<Tip>
  A device configured as a Collector shows the **integrations connected through
  it** in its
  [detail view](/documentation/agent-endpoint-security/device-details).
</Tip>

## Related

<CardGroup cols={2}>
  <Card title="Endpoint mode" icon="desktop" href="/documentation/agent-endpoint-security/endpoint-mode">
    Run the agent as a monitored host instead.
  </Card>

  <Card title="Deploying the agent" icon="download" href="/documentation/agent-endpoint-security/installation">
    Install the agent, then set its role from the device detail view.
  </Card>
</CardGroup>