To analyze application, host and user behavior, Lacework uses a lightweight agent, which securely forwards collected metadata to the Lacework cloud for analysis. The agent requires minimal system resources and runs on most 64-bit Linux distributions such as the following.
| Operating System | Versions |
| Ubuntu | 12.04, 12.04.1 LTS, 12.04.2 LTS, 12.04.3 LTS, 12.04.4 LTS, 12.04.5 LTS, 13.10, 14.04 LTS, 14.04.1 LTS, 14.04.2 LTS, 14.04.3 LTS, 14.04, 14.04.4 LTS, 14.04.5 LTS, 14.10, 15.04, 15.10, 16.04.1 LTS, 16.04.2 LTS, 16.04.3 LTS, 16.04.4 LTS, 16.04.5 LTS, 16.04.6 LTS, 17.04, 17.10, 18.04 LTS, 18.04.1 LTS, 18.04.2 LTS, Wily Werewolf (development branch) |
| Fedora | 21, 22, 23 (Cloud Edition), 24 (Cloud Edition) |
| Redhat Enterprise Linux | 6.7, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 |
| CentOS | 7 (Core), 6.3, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10 |
| Debian | 7 (Wheezy), 8 (Jessie), 9 (Stretch) |
| Amazon Linux | 2, 2 (2017.12) LTS Release Candidate, 2014.03, 2014.09, 2015.03, 2015.09, 2016.03, 2016.09, 2017.03, 2017.09, 2018.03 |
| CoreOS | 16.04 |
| Container Linux by CoreOS | 1298.7.0, 1576.5.0, 1632.3.0, 1800.5.0, 1967.6.0, 2023.3.0 |
| Container-Optimized OS from Google | |
| Kali GNU/Linux Rolling | |
| Scientific | 6.4, 6.5, 6.10 |
| SUSE | 12 SP1 |
When configured to run as a container, the agent runs as a privileged Docker container.