The Linux agent runs on the endpoints themselves, across every major distribution, and feeds activity into the same console your team already uses.
Schedule a Demo
Linux desktops and developer workstations are a growing share of enterprise environments — and most monitoring tools simply skip them.
Linux desktops and servers are a growing share of enterprise environments — developer workstations, CI/CD build agents, customer-facing kiosks, back-office terminals, and remote VPN nodes. Attackers and malicious insiders know that many DLP and monitoring tools simply skip non-Windows machines. A Linux endpoint with an active user session, a browser, a USB port, and access to internal file shares is an insider-threat surface that needs the same visibility as any Windows PC.
Anexet closes that gap with a native Linux agent. Rather than routing traffic through a network proxy (which misses local activity and encrypted application data), the agent deploys directly on the endpoint and observes user activity at the source. Not every interception channel available on Windows is available on Linux, so the exact set is confirmed for your distributions during the demo.
Management is Linux-native too, not just monitoring. The Administrator Console and the Client Console both run on Linux workstations via Wine, with full feature parity with the Windows builds — a Linux-first security team can deploy agents, review intercepted sessions, run reports, and manage policies entirely from its own Linux machines, without keeping a Windows box around just to open the console.
Because the entire deployment is on-premise, every byte of intercepted data stays inside your perimeter. The vendor — Scinero Software Limited — has no access to your infrastructure, your users' activity, or the content of any intercepted communication.
Deployed directly on each Linux workstation, without a network proxy, so activity is observed at the source.
The Administrator Console and Client Console both run on Linux via Wine, with full Windows feature parity — manage the whole fleet, including Windows and macOS endpoints, from a Linux workstation.
All intercepted data stays inside your network. Scinero Software Limited has no access to your data.
The native Linux agent feeds the same search and reporting pipeline used for Windows and macOS endpoints, with policy-based alerting and blocking layered on top.
Screenshots of the Linux desktop session are captured and stored in the intercepted data index. This function requires an X11 graphical session.
Automatic desktop recording on a schedule. Like screenshots, it requires an X11 graphical session; all other supported agent functions also work under Wayland.
Network resources are controlled on Linux through mount points over SMB and NFS. All network resource control settings are available except control of writing to network resources.
Policy rules fire on intercepted data from Linux endpoints; notifications are generated on rule match.
Blocking Policies are available for the Linux agent, but blocking coverage is partial and depends on the channel. Our team confirms which channels can be blocked on your distributions during the demo.
Every intercepted event from Linux endpoints is indexed and searchable through the Information Search module.
Linux endpoints appear in all standard activity and incident reports.
Not every interception channel available on Windows is available on Linux, and coverage varies by distribution. Our team confirms the exact capability matrix for your environment during the demo.
The Anexet agent runs directly on each Linux endpoint and captures user activity as it occurs, including desktop screenshots. The set of captured channels differs from Windows and is confirmed for your distributions during the demo. Captured data is compressed and forwarded to the Data Processing Server inside your own network; all traffic stays on your internal infrastructure, never leaving your perimeter.
Because the entire deployment is on-premise, Scinero Software Limited has no access to your data. The vendor operates no cloud backend that receives customer activity. Every intercepted event from your Linux endpoints is stored on the Anexet server you control, inside your own data centre or private cloud.
From agent deployment to searchable records in the Client Console.
The Administrator Console deployment wizard pushes the Linux agent package to the selected computers or to all computers from a directory service such as FreeIPA, with no manual installation required per machine at scale. The Administrator Console itself can run on a Linux workstation via Wine, so a Linux-based security team never has to switch to Windows to run the deployment.
1
Once installed, the agent runs silently in the background, capturing user activity on the endpoint, then compressing and forwarding data to your on-premise Index Server. Which channels are captured on Linux is confirmed for your distributions during the demo.
2
The Index Server unifies data from Linux, Windows, and macOS endpoints into a single search index — analysts filter by user, date, channel, or keyword in the Information Search module without a separate Linux interface.
3
Activity captured on Linux endpoints appears in the Client Console alongside Windows and macOS endpoints; reports aggregate Linux endpoints into fleet-level views, with live Dashboard widgets summarizing results across the whole endpoint fleet.
4
The Administrator Console deployment wizard pushes the Linux agent package to the selected computers or to all computers from a directory service such as FreeIPA, with no manual installation required per machine at scale. The Administrator Console itself can run on a Linux workstation via Wine, so a Linux-based security team never has to switch to Windows to run the deployment.
1
Once installed, the agent runs silently in the background, capturing user activity on the endpoint, then compressing and forwarding data to your on-premise Index Server. Which channels are captured on Linux is confirmed for your distributions during the demo.
2
The Index Server unifies data from Linux, Windows, and macOS endpoints into a single search index — analysts filter by user, date, channel, or keyword in the Information Search module without a separate Linux interface.
3
Activity captured on Linux endpoints appears in the Client Console alongside Windows and macOS endpoints; reports aggregate Linux endpoints into fleet-level views, with live Dashboard widgets summarizing results across the whole endpoint fleet.
4
Common questions about Anexet's Linux monitoring agent.
Anexet deploys a native agent on Linux, Windows, and macOS endpoints alike. Linux support covers Ubuntu 18.04 and later, Debian 11 and later, Fedora 33 and later, CentOS 8, RHEL 8 and later, AlmaLinux 9.1 and later, Oracle Linux 8.10 and later, Rosa R12 and later, Astra Linux 1.7 and later, ALT Linux 10.1 and later (Alt Server 9.2), and RedOS 7.3.1 and later. All three OS families feed into the same unified Console and search index.
The Linux agent is available from the Standard plan, with full-text search and reports on the data it captures. Security Policies and Blocking Policies require Advanced or Premium; Risk Analysis and Investigations require Premium. The set of channels captured on Linux is confirmed during the demo.
Yes. Anexet is deployed on-premise; the vendor has no access to your data. The agent on each Linux endpoint sends data only to your own Anexet server inside your network. No traffic is routed through Scinero's infrastructure, no telemetry leaves your perimeter, and no cloud service is involved in interception or storage.
No. Scinero Software Limited operates no cloud backend that receives customer data. All intercepted activity from Linux endpoints is stored on the Anexet server you control, inside your own data centre or private cloud. The vendor has no access to your data.
Partly, on Advanced and Premium. Blocking Policies are available for the Linux agent, but blocking coverage on Linux is partial and depends on the channel. Our team confirms which channels can be blocked on your distributions during the demo. On Standard, the agent captures and logs but does not block.
Yes. Both the Administrator Console and the Client Console run on Linux workstations via Wine, with the full feature set of the Windows consoles — deployment, policy configuration, Information Search, reporting, and the User Activity module. A Linux-based security or IT team can manage the entire Anexet deployment, including Windows and macOS endpoints, without a Windows machine anywhere in the loop.
Yes. Anexet integrates with Active Directory and Microsoft Entra ID, and also supports FreeIPA — the standard identity provider for Linux-centric infrastructures. User accounts from FreeIPA can be mapped to monitored endpoints, so activity is attributed to named users rather than machine identities.
Tell us which Linux distributions you run and what you need to protect — we'll map it to the right plan and arrange a demo or a free trial of Anexet Ultimate.
