To analyze application, host and user behavior, Lacework uses a lightweight agent, which securely forwards collected metadata to the Lacework cloud for analysis.The agent requires minimal system resources and runs on most 64-bit Linux distributions such as the following.
| Operating System | Versions |
| Ubuntu | 12.04, 13.10, 14.04, 14.10, 15.04, 15.10 |
| Fedora | 21, 22, 23 |
| Redhat Enterprise Linux | 6.7, 7.1 |
| Centos | 7 |
| Debian | wheezy, Jessie |
| Amazon Linux | 16-03, 15-09, 15-03, 14-09, 14-03 |
| CoreOS | 16.04 |
When configured to run as a container, the agent runs as a privileged Docker container.