> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Capabilities

> What the Myrmex software agent really does: rich host telemetry, response actions on the host, host-hardening audits that feed Security Posture, and patch management — all driven by the Myrmex AI agents.

import { CardGroup, Card, Note, Tip } from '@mintlify/components';

The Myrmex **software agent** installed on a host does two things well: it **collects** deep telemetry from the operating system, and it **acts** on the host when told to. Both are driven by the [AI agents](/documentation/multi-agent-system/overview) — you ask in the Workspace, and [Perseus](/documentation/multi-agent-system/agent-endpoint-specialist), coordinated by [Centurion](/documentation/multi-agent-system/agent-orchestrator), operates the agent for you.

<Note>
  "Agent" here means the **software agent** on the host. The **AI agents** decide
  what to collect and what to do — the software agent carries it out.
</Note>

## Host Telemetry

The agent observes the operating system across kernel and user space:

<CardGroup cols={2}>
  <Card title="Processes" icon="diagram-project">
    Process and thread creation, termination, and hierarchy, with the commands
    behind them.
  </Card>

  <Card title="Files & filesystem" icon="folder-tree">
    File access, changes, and deletions, including changes to system binaries and
    libraries.
  </Card>

  <Card title="Network & DNS" icon="network-wired">
    Network connections and traffic patterns, with heavy DNS-resolution
    monitoring.
  </Card>

  <Card title="Windows Event Log & registry" icon="windows">
    Windows Event Log via ETW, and registry activity — on Windows hosts.
  </Card>

  <Card title="Linux audit & syslog" icon="linux">
    The Linux audit subsystem and syslog — on Linux hosts.
  </Card>

  <Card title="Hardware & software inventory" icon="box">
    A current inventory of the host's hardware and installed software.
  </Card>
</CardGroup>

<Note>
  Some telemetry is platform-specific: registry and Windows Event Log/ETW are
  Windows-only, while audit and syslog apply to Linux. The agent supports
  Windows, Linux, and macOS.
</Note>

## Response Actions

When you approve them, the AI agents operate the software agent to act on the host:

* **Isolate the host** from the network to contain an incident.
* **Quarantine** a malicious or suspicious file.
* **Kill or terminate a process** running on the device.
* **Run commands** on the host to investigate or remediate.
* **Manage services, users, and updates** on the operating system.

<Note>
  Actions that change a host follow the **AI proposes, you approve** pattern — you
  review and approve before anything runs. See
  [Perseus](/documentation/multi-agent-system/agent-endpoint-specialist) for how
  response works.
</Note>

## Host-Hardening Audits

The agent runs on-demand **host-hardening audits** that check the device's configuration against best practice. Findings feed into [Security Posture](/documentation/security-posture/overview), where [Athena](/documentation/multi-agent-system/athena) scores your environment and prioritizes what to fix first.

## Patch Management

The agent applies approved operating-system updates on the host. Updates are scheduled and approved through [patch management](/documentation/agent-endpoint-security/patch-management), keeping you in control of what changes and when.

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Agent architecture" icon="sitemap" href="/documentation/agent-endpoint-security/architecture">
    The collect → enrich → respond model behind these capabilities.
  </Card>

  <Card title="Perseus" icon="terminal" href="/documentation/multi-agent-system/agent-endpoint-specialist">
    The AI agent that drives response on your hosts.
  </Card>

  <Card title="Security Posture" icon="shield-halved" href="/documentation/security-posture/overview">
    Where host-hardening findings surface.
  </Card>

  <Card title="Patch & updates" icon="arrows-rotate" href="/documentation/agent-endpoint-security/patch-management">
    Schedule and approve OS updates.
  </Card>
</CardGroup>

<Tip>
  To see or act on a single host, open it in [Device
  details](/documentation/agent-endpoint-security/device-details) or `@`-mention
  it in chat.
</Tip>