Built-in Collectors

Every enrolled endpoint is profiled out of the box. The Hermes agent ships with a set of built-in collectors that gather a full hardware and software picture on each inventory cycle — no configuration required — and the results appear on the device page in the console.

How collection works#

Collectors run automatically on the agent and report back over the gRPC channel. Inventory is gathered in modules, each streamed individually as it completes, so the console fills in progressively rather than waiting for one large payload. On Windows, collectors draw on WMI, the registry, DISM, and performance counters. For collection cadence, refresh, and the query API, see Inventory.

The collector catalog#

These collectors are built in and enabled by default:

Collector	What it gathers
`os`	Edition, display version, build number, install date, domain/workgroup, server vs. client, Server Core.
`hardware`	Manufacturer, model, serial, UUID, chassis type, BIOS version, total RAM, and whether the host is a virtual machine.
`bootsecurity`	Secure Boot state, TPM presence and version, and pending-restart status.
`processors`	CPU model, core and logical-processor counts, clock speed.
`memory`	Per-slot modules: capacity, speed, and memory type (e.g. DDR4/DDR5).
`storage`	Physical disks and volumes: model, capacity, free space, media type.
`network`	Adapters and IP configuration: addresses, MAC, gateway, DNS.
`shares`	Shared folders published by the host.
`software`	Installed applications with name, version, publisher, and install date.
`services`	Windows services: name, status, and start type.
`environment`	System environment variables.
`updates`	Installed hotfixes / KBs (and, with offline scanning, missing updates).
`features`	Windows optional features and roles (via DISM) — e.g. AD Domain Services.
`localgroups`	Local groups and their membership.
`metrics`	Live CPU, memory, and disk utilization.
`agentinfo`	Agent version, certificate status, and runtime details.

From this data the server also derives quick flags for each device — is a server, domain controller, virtual machine, and domain-joined — for filtering and targeting.

In the console#

Each collector surfaces as a tab on the device page, so the full inventory for a machine is one click away. The screenshots below show the collected data as it appears in Athena.

Screenshot: device overview page

Device overview — OS, hardware, boot security, and live metrics at a glance.

Screenshot: software inventory tab

Software inventory — installed applications with version, publisher, and install date.

Screenshot: hardware & boot security

Hardware & boot security — model, serial, TPM, Secure Boot, memory and storage.

Extending collection#

Need to capture something specific to your environment? Beyond these built-ins you can add your own checks with Agent Modules (Python, PowerShell, or EXE), which appear alongside the built-in data on the device page.