To analyze application, host, and user behavior, Lacework uses a lightweight agent, which securely forwards collected metadata to the Lacework cloud for analysis. The agent requires minimal system resources and runs on most 64-bit Linux distributions such as the following.
x86 Architecture
| Operating System | Versions |
|---|---|
| Alpine Linux (General beta support) | 3.10, 3.11, 3.12, 3.13, 3.14 |
| Amazon Linux | 2 |
| Amazon Linux AMI | 2016.03, 2016.09, 2017.03, 2017.09, 2018.03 |
| CentOS | 6.x, 7.x, 8.x |
| Container-Optimized OS from Google | 81, 85, 89 |
| Debian | 9 (Stretch), 10 (Buster), 11 (Bullseye) |
| Fedora | 30, 31, 32, 33, 34 |
| Kali GNU/Linux Rolling | Rolling distribution |
| Oracle Linux | 8.3, 8.4 |
| Redhat Enterprise Linux | 7.9, 8.0, 8.1.0, 8.2, 8.3, 8.4 |
| SUSE | 11.4.20, 12 SP1, 12 SP5, 15, 15 SP1 |
| Ubuntu | 16.04, 16.10, 17.04, 17.10, 18.04, 18.10, 19.04, 19.10, 20.04, 21.04, 21.10 |
| Rocky Linux | 8.4 |
When configured to run as a container, the agent runs as a privileged Docker container.
ARM64 Architecture
Lacework supports AWS Graviton and Graviton2 ARM-based instances. You can install the Lacework agent on the following operating systems.
| Operating System | Versions |
|---|---|
| Amazon Linux | 2 |
| CentOS | 6.10, 8.2 |
| Debian | 9 (Stretch), 10 (Buster), 11 (Bullseye) |
| Fedora | 30, 31, 32, 33, 34 |
| Redhat Enterprise Linux | 7.9, 8.0, 8.1, 8.2, 8.3, 8.4 |
| SUSE | 12 SP5, 15 SP2 |
| Ubuntu | 16.04, 17.04, 18.04, 19.04, 20.04, 21.04, 21.10 |
| Rocky Linux | 8.4 |
Container Runtime
| Container Runtime | Min. Agent Version |
|---|---|
| Dockerd | All |
| Containerd | > Agent v3.8.2 |
| CRI-O | > Agent v5.0 |