Skip to main content
A device in Agent (endpoint) role is a first-class monitored host. The software agent installed on it collects that machine’s telemetry and carries out response actions on it. It runs on Windows, Linux and macOS.
This is the software agent installed on the host. The decisions come from the AI agents — Perseus runs endpoint operations and Brontes administers your fleet. The software agent doesn’t act on its own; see Agent architecture.

​
What It Does

Collects host telemetry

Processes, files, network and DNS, the Windows registry and Event Log, the Linux audit subsystem and syslog, plus the hardware and software inventory.

Runs response actions

Isolate the host, quarantine a file, kill a process, run a command, and manage services, users and updates — on the AI agents’ instruction.
It also runs host-hardening audits that feed Security Posture, and surfaces pending updates for patch management. For the full list of what the agent can do and on which platforms, see Agent capabilities.

​
Switching Roles

The same agent can run as a Collector instead, bridging Myrmex to systems that can’t run an agent themselves. You switch a device between Agent and Collector from its detail view — no reinstall needed.

Device details & actions

Authorize the device, switch its role, and review its system information.

Collector mode

Reach systems that can’t run the agent themselves.
Not installed yet? Follow Deploying the agent and then authorize the new device to start collecting.