> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Perseus

> Perseus is the endpoint specialist among the Myrmex AI agents — it investigates hosts in depth and runs response actions through the installed software agent: isolate, quarantine, kill a process, remediate, harden.

import { CardGroup, Card, Note, Tip } from '@mintlify/components';

**Perseus** is the endpoint specialist among the Myrmex AI agents. When something needs to happen *on a host* — a deeper look at what's running, or a response to contain a threat — Perseus is the specialist that does it, operating the Myrmex [software agent](/documentation/agent-endpoint-security/features) installed on the device.

<Note>
  Perseus is an **AI agent**. The **software agent** is the program installed on
  the host. Perseus *drives* that software agent to investigate and act — the two
  share the word "agent" but are not the same thing.
</Note>

## Investigating a Host

Perseus can look closely at a single machine to understand what's really happening on it — the running processes and their relationships, network connections, files, and the events the host has recorded. This is the detail you need to confirm whether an alert is real and to understand its scope before you respond.

## Response Actions

Once you know what you're dealing with, Perseus carries out the response — always with your approval:

<CardGroup cols={2}>
  <Card title="Isolate the host" icon="network-wired">
    Cut a device off from the network to contain an incident while you work it.
  </Card>

  <Card title="Quarantine" icon="box-archive">
    Contain a malicious or suspicious file so it can no longer run.
  </Card>

  <Card title="Kill a process" icon="ban">
    Terminate a running process on the host.
  </Card>

  <Card title="Remediate" icon="screwdriver-wrench">
    Clean up and apply fixes — run commands, manage services and users, and more.
  </Card>

  <Card title="Harden" icon="shield-halved">
    Tighten a host's configuration against best practice, feeding
    [Security Posture](/documentation/security-posture/overview).
  </Card>
</CardGroup>

## AI Proposes, You Approve

Anything Perseus does that changes a host is **proposed for your approval first**. You ask in chat — scoping to the machine with an `@`-mention — Perseus explains what it intends to do, and nothing runs on your device until you say so.

## Perseus vs. Brontes

Perseus and [Brontes](/documentation/multi-agent-system/agent-endpoint-manager) are the two endpoint agents:

* **Perseus acts** — investigates a host in depth and runs response actions on it.
* **Brontes manages** — tracks the health, configuration, and installed software of your registered assets.

Use Brontes to understand your fleet; [Centurion](/documentation/multi-agent-system/agent-orchestrator) brings in Perseus when it's time to do something to a specific host.

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Agent capabilities" icon="list-check" href="/documentation/agent-endpoint-security/features">
    The telemetry and response actions the software agent provides.
  </Card>

  <Card title="Device details & actions" icon="desktop" href="/documentation/agent-endpoint-security/device-details">
    Where you run and review actions on a single host.
  </Card>

  <Card title="Brontes" icon="computer" href="/documentation/multi-agent-system/agent-endpoint-manager">
    The endpoint manager that tracks your assets.
  </Card>

  <Card title="Centurion" icon="brain-circuit" href="/documentation/multi-agent-system/agent-orchestrator">
    The orchestrator that brings Perseus in.
  </Card>
</CardGroup>

<Tip>
  During an investigation, ask Centurion to investigate an alert and it will
  bring Perseus in automatically to inspect the affected host.
</Tip>