To analyze application, host and user behavior, Lacework uses a lightweight agent, which securely forwards collected metadata to the Lacework cloud for analysis. The agent requires minimal system resources and runs on most 64-bit Linux distributions such as the following.
| Operating System | Versions |
| Amazon Linux | 2 |
| Amazon Linux AMI | 2014.03, 2014.09, 2015.03, 2015.09, 2016.03, 2016.09, 2017.03, 2017.09, 2018.03 |
| Ubuntu | 12.04, 13.10, 14.04, 14.10, 15.04, 15.10, 16.04, 16.10, 17.04, 17.10, 18.04, 18.10, 19.04, 19.10 |
| Fedora | 21, 22, 23 (Cloud Edition), 24 (Cloud Edition), 28, 29, 30, 31 |
| Redhat Enterprise Linux | 6.7, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 7.7, 8.0, 8.1.0 |
| CentOS | 7 (Core), 6.3, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10 |
| Debian | 7 (Wheezy), 8 (Jessie), 9 (Stretch), 9.5, 10 (Buster) |
| CoreOS | 16.04 |
| Container Linux by CoreOS | 1298.7.0, 1576.5.0, 1632.3.0, 1800.5.0, 1967.6.0, 2023.3.0 |
| Container-Optimized OS from Google | 69, 73 |
| Kali GNU/Linux Rolling | rolling distribution |
| Scientific | 6.4, 6.5, 6.10 |
| SUSE | 12 SP1, 12 SP5, 15, 15 SP1 |
When configured to run as a container, the agent runs as a privileged Docker container.