Contents x
    Linux
    • 03 Mar 2023
    • 1 Minute to read
    • Contributors
    • Print
    • Dark
      Light
    Contents
      This documentation version is deprecated, please click here for the latest version.

    Linux

    • Updated on 03 Mar 2023
    • 1 Minute to read
    • Contributors
    • Print
    • Dark
      Light
    Article summary

    The LimaCharlie Linux sensor interfaces with the kernel to acquire deep visibility into the host's activity while taking measures to preserve the host's performance. We make full use of eBPF, which requires Linux 4.4 or above.

    The Sensor current supports all Linux distributions (including ARM and MIPS).

    Linux Distribution Support

    Our Linux Sensor fully utilizes eBPF, which requires at least Linux 4.4 or above. Use the command uname -r to check your kernel version to determine support.

    Installation Instructions

    Sensor installation instructions can be found here.

    Supported Events

    Supported Commands

    Artifacts

    Given configured paths to collect from, the Linux sensor can batch upload logs / artifacts directly from the host.

    Learn more about collecting Artifacts here.

    Payloads

    For more complex needs not supported by Events, Artifacts, or Commands, it's possible to execute payloads on hosts via the Linux sensor.

    Learn more about executing Payloads here.

    Was this article helpful?
    What's Next