---
title: "Transparent router mode"
url: "https://axoflow.com/docs/axoflow/0.86/deployment-scenarios/transparent-router/"
last_modified: "2026-09-14T15:34:47+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Transparent router mode

[AxoRouter](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#router) is a powerful aggregator and data processing engine that can receive data from a wide variety of [sources](https://axoflow.com/docs/axoflow/0.86/data-sources/index.md), including:

- OpenTelemetry,
- syslog,
- Windows Event Forwarding, or HTTP.

In transparent mode, you deploy AxoRouter in front of your [SIEM](https://axoflow.com/docs/axoflow/0.86/destinations/index.md) and configure your sources or aggregators to send the logs to AxoRouter instead of the SIEM. The transparent deployment method is a quick, minimally invasive way to get instant benefits and value from Axoflow, and:

- automatically identify the sending device or application,
- [apply device-specific, zero-maintenance parsers](https://axoflow.com/docs/axoflow/0.86/concepts/automatic-data-processing/index.md) to the incoming data,
- enrich the incoming messages with metadata, and
- get metrics about the data throughput.

> **Note:**
> Note that AxoRouter and Axoflow agent collects detailed, real-time metrics about the data-flows – giving you observability over the health of the security data pipeline and its components. Your security data remains in your self-managed cloud or in your on-prem instance where your sources, destinations, Axoflow agents, and AxoRouters are running, only metrics are forwarded to AxoConsole.

![Transparent deployment as SaaS or on-prem](https://axoflow.com/docs/axoflow/0.86/img/deployment-transparent-saas.svg)