The Linux agent runs on the endpoints themselves, across every major distribution, and feeds activity into the same console your team already uses.
Schedule a Demo
Linux desktops and developer workstations are a growing share of enterprise environments — and most monitoring tools simply skip them.
Linux desktops and servers are a growing share of enterprise environments — developer workstations, CI/CD build agents, customer-facing kiosks, back-office terminals, and remote VPN nodes. Attackers and malicious insiders know that many DLP and monitoring tools simply skip non-Windows machines. A Linux endpoint with an active user session, a browser, a USB port, and access to internal file shares is an insider-threat surface that needs the same visibility as any Windows PC.
Anexet closes that gap with a native Linux agent. Rather than routing traffic through a network proxy (which misses local activity and encrypted application data) the agent deploys directly on the endpoint, where it can observe user sessions, network connections, and device activity at the source.
Management is Linux-native too, not just monitoring. The Administrator Console and the Client Console both run on Linux workstations via Wine, with full feature parity with the Windows builds — a Linux-first security team can deploy agents, review intercepted sessions, run reports, and manage policies entirely from its own Linux machines, without keeping a Windows box around just to open the console.
Because the entire deployment is on-premise, every byte of intercepted data stays inside your perimeter. The vendor — Scinero Software Limited — has no access to your infrastructure, your users' activity, or the content of any intercepted communication.
Deployed directly on each Linux workstation — no network proxy, no gaps in encrypted or local activity.
The Administrator Console and Client Console both run natively on Linux via Wine, with full Windows feature parity — manage the whole fleet, including Windows and macOS endpoints, from a Linux workstation.
All intercepted data stays inside your network. Scinero Software Limited has no access to your data.
The native Linux agent feeds the same interception, search, and reporting pipeline used for Windows and macOS endpoints, with policy-based alerting, blocking, and forensic tooling layered on top.
HTTP, FTP, XMPP, web mail, web messengers, and social networks intercepted at the agent level on each Linux workstation.
Desktop messenger sessions (Telegram, Viber, and others where the desktop client runs on Linux) intercepted end-to-end.
Web activity through monitored browsers captured as intercepted sessions.
Desktop cloud-sync clients (where available on Linux) monitored for uploads and downloads.
Clipboard contents sampled and logged for policy review.
USB, COM, and LPT port events logged; removable storage connects and disconnects appear in the Console.
Local and network print jobs tracked per user.
User session start/end, application run times, active vs. idle periods recorded in the User Activity module.
Periodic or triggered screenshots captured from the Linux desktop session and stored in the intercepted data index.
Scheduled microphone and desktop recording available on supported Linux builds.
Every intercepted event from Linux endpoints is indexed and searchable through the Information Search module.
Linux endpoints appear in all standard activity and incident reports; Report Wizard supports filtering by OS or user group.
Keystroke logging on Linux endpoints.
Policy rules fire on intercepted data from Linux endpoints; notifications generated on rule match.
Transfer blocking (HTTP, SMTP, clipboard, USB, process-level network) enforced on Linux agents.
File and folder operation audit on Linux workstations and accessible network shares.
File-share activity from Linux endpoints logged.
Coverage may vary by Linux distribution. Our team confirms the exact capability matrix for your environment during the demo.
The Anexet agent runs directly on each Linux endpoint, capturing network sessions, device events, application activity, clipboard contents, screenshots, and keystrokes (Advanced and above) as they occur. Captured data is compressed and forwarded to the Data Processing Server inside your own network — all traffic stays on your internal infrastructure, never leaving your perimeter.
Because the entire deployment is on-premise, Scinero Software Limited has no access to your data. The vendor operates no cloud backend that receives customer activity. Every intercepted event from your Linux endpoints is stored on the Anexet server you control, inside your own data centre or private cloud.
From agent deployment to searchable records in the Client Console.
The Administrator Console deployment wizard pushes the Linux agent package to target machines by hostname, IP range, or directory group — no manual SSH installation per machine required at scale. The Administrator Console itself can run on a Linux workstation via Wine, so a Linux-based security team never has to switch to Windows to run the deployment.
1
Once installed, the agent runs silently in the background, intercepting network sessions, device events, application activity, and clipboard contents, then compressing and forwarding data to your on-premise Index Server.
2
The Index Server unifies data from Linux, Windows, and macOS endpoints into a single search index — analysts filter by user, date, channel, or keyword in the Information Search module without a separate Linux interface.
3
Each Linux user's activity timeline, application usage, and productivity breakdown appear in the User Activity module; reports aggregate Linux endpoints into fleet-level views, with live Dashboard widgets summarizing results across the whole endpoint fleet.
4
The Administrator Console deployment wizard pushes the Linux agent package to target machines by hostname, IP range, or directory group — no manual SSH installation per machine required at scale. The Administrator Console itself can run on a Linux workstation via Wine, so a Linux-based security team never has to switch to Windows to run the deployment.
1
Once installed, the agent runs silently in the background, intercepting network sessions, device events, application activity, and clipboard contents, then compressing and forwarding data to your on-premise Index Server.
2
The Index Server unifies data from Linux, Windows, and macOS endpoints into a single search index — analysts filter by user, date, channel, or keyword in the Information Search module without a separate Linux interface.
3
Each Linux user's activity timeline, application usage, and productivity breakdown appear in the User Activity module; reports aggregate Linux endpoints into fleet-level views, with live Dashboard widgets summarizing results across the whole endpoint fleet.
4
Common questions about Anexet's Linux monitoring agent.
Anexet deploys a native agent on Linux, Windows, and macOS endpoints alike. Linux support covers Ubuntu 18.04 and later, Debian 11 and later, Fedora 33 and later, CentOS 8, RHEL 8 and later, AlmaLinux 9.1 and later, Oracle Linux 8.10 and later, Rosa R12 and later, Astra Linux 1.7 and later, ALT Linux 10.1 and later (Alt Server 9.2), and RedOS 7.3.1 and later. All three OS families feed into the same unified Console and search index.
The Linux agent is available from the Standard plan. Standard includes network interception, USB/device control, printer monitoring, messenger and browser interception, clipboard monitoring, screenshots, PC activity tracking, audio/video recording, full-text search, and reports. Keylogger, Security Policies, and Blocking Policies require Advanced or Premium; Risk Analysis and Investigations require Premium.
Yes. Anexet is deployed on-premise; the vendor has no access to your data. The agent on each Linux endpoint sends data only to your own Anexet server inside your network. No traffic is routed through Scinero's infrastructure, no telemetry leaves your perimeter, and no cloud service is involved in interception or storage.
No. Scinero Software Limited operates no cloud backend that receives customer data. All intercepted activity from Linux endpoints is stored on the Anexet server you control, inside your own data centre or private cloud. The vendor has no access to your data.
Yes, on Advanced and Premium. Blocking Policies on the Linux agent can prevent data transfers over HTTP, SMTP, clipboard, USB storage, and at the process-network level. On Standard, the agent captures and logs everything but does not block.
Yes. Both the Administrator Console and the Client Console run natively on Linux workstations via Wine, with the full feature set of the Windows consoles — deployment, policy configuration, Information Search, reporting, and the User Activity module. A Linux-based security or IT team can manage the entire Anexet deployment, including Windows and macOS endpoints, without a Windows machine anywhere in the loop.
Yes. Anexet integrates with Active Directory and Microsoft Entra ID, and also supports FreeIPA — the standard identity provider for Linux-centric infrastructures. User accounts from FreeIPA can be mapped to monitored endpoints, so activity is attributed to named users rather than machine identities.
Tell us which Linux distributions you run and what you need to protect — we'll map it to the right plan and arrange a demo or a free trial of Anexet Ultimate.
