Skip to main content
Opening a device gives you everything about that one host in a single tab — how it’s doing, what it is, how you want the AI to treat it, and the actions you can take on it. Open a device from the Directory tree — expand Environment, then its group (for agent devices, Endpoint) and click the host; see the Endpoints view — or by @-mentioning it in chat.

​
The Device Tabs

A device opens on Overview and carries five tabs:

​
Overview: This Host’s Posture

Overview is a posture dashboard for this one device — the same shape as the environment-wide dashboard, scoped to the host:
  • a score out of 100 with a letter grade and its 30-day change, and a Generate report button;
  • a score per category, each marked healthy, watch or at risk;
  • score over time and issue evolution across the last 30 days;
  • a MITRE ATT&CK breakdown, tactic by tactic, showing what’s covered, failing and uncovered;
  • conformity by framework, with a gauge for each framework that applies to this host.
The findings behind those numbers live in the Findings tab. What gets collected in the first place is the Audit and Vulnerability modules, switched on in Configuration — see Frameworks & scanning.
A device's Overview tab, with its posture score, category scores and trends

​
System Information

At the bottom of Overview, the Information section is a live snapshot reported by the Myrmex agent, grouped as System, Hardware, Network and Agent:
  • Operating system and version
  • CPU and memory
  • Public IP address
  • Agent version, and the date it was installed
The device’s identifier sits under its name in the header, with a button to copy it. This is the same picture Brontes keeps current across your whole fleet, focused on a single host.

​
Authorizing a Device

A newly installed device first appears as unauthorized and does not report until you approve it. This manual step means a device only becomes active in Myrmex once you say so.
1

Install the agent

Onboard the host through the Download Agent flow. It registers as unauthorized.
2

Authorize it

Open the device and choose Authorize. It activates and begins reporting.
You can Unauthorize a device later to stop it from reporting without removing it from your inventory.

​
Device Role: Agent or Collector

Every device runs in one of two roles, and you can switch between them here:

Agent

The host protects itself — collecting telemetry and running response actions locally.

Collector

The host acts as a real-time bridge, reaching external systems over SSH or their APIs. Collectors also list their connected integrations.

​
Editing a Device

Adjust how a device is identified and prioritized:
  • Name and description — label the host in terms your team recognizes.
  • Severity — mark how critical the device is, so investigations and posture reviews weigh it accordingly.
  • Tags — apply labels that also govern who can access the device.

​
Rules and Memory

Two settings shape how the AI works with a device:

Rule

A free-text, natural-language instruction you write for the AI — for example, “prefer PowerShell on this host” or “never restart this server during business hours.” The agents follow it whenever they act on the device.

Memory

A running record the AI maintains about the device as it learns. It’s read-only — you review it, the AI keeps it current.
Rules also work at the folder level, so you can steer a whole group of devices at once. See Folders & rules.

​
Private Credential

By default, what the AI runs on a host executes under the system account. In Configuration, the Private credential switch changes that: each user has to supply their own OS account, and operations then run as that user — so the host’s own logs attribute the action to the person who asked for it.
This is the device-level counterpart of the private credentials you can set on an integration — see Shared vs. private credentials.

​
Running Actions on the Host

Response and remediation actions on a device are carried out by Perseus, the endpoint specialist, working through the installed agent. Ask in chat — scoping to the device with an @-mention — and Perseus can:
  • Isolate the host from the network to contain an incident.
  • Kill or terminate a process running on the device.
  • Remediate — clean up and apply fixes on the host.
Actions that change a host follow the “AI proposes, you approve” pattern — you stay in control of what runs on your devices.

​
Where to Go Next

Endpoints view

Browse and organize your whole device inventory.

Patch & updates

Review and schedule OS updates for this host.

Perseus

The specialist that acts on your hosts.

Endpoint vs Collector

How the two device roles differ.