Verified with Defensia agent v1.4.92
Defensia runs on all major Linux distributions. Auto-detects your distro, init system, auth log path, and architecture.
Debian-based
/var/log/auth.logDebian-based
/var/log/auth.logRed Hat Enterprise Linux
/var/log/secureRHEL-compatible
/var/log/secureRHEL-compatible
/var/log/secureRHEL-compatible
/var/log/secureRHEL-compatible
/var/log/secureAWS
/var/log/secureThese are version floors, not snapshots. The agent never branches on your distro version — it detects the init system, the auth log path and the package manager at runtime — so anything at or above the floor is covered, including releases newer than this page. Across the production fleet the agent currently reports 26 distinct distribution/version combinations. If yours is listed above and does not work, that is a bug worth reporting.
Reported working by users, not officially tested
These distributions should work but are not officially tested. The agent auto-detects your init system (systemd, Upstart, SysVinit) and package manager (apt, yum, dnf).
Rolling releases (Arch, Manjaro, Gentoo) need agent 1.4.78 or newer. /etc/os-release makes VERSION_ID optional and these distros omit it; earlier agents sent an empty version and registration was rejected. The agent now reports unknown as the version, which is what you will see in the dashboard for these systems. A fresh install always gets the current agent, so this only affects installs attempted before 19 October 2026.
Alpine and other apk-based systems: the shell installer needs apt, yum or dnf to install its dependencies and will stop with a clear error on Alpine. Run the agent as a container instead — the official image is Alpine-based and is the supported path on these hosts. See Container Platforms below.
Deploy as a container alongside your existing stack
Single container — privileged, host network
docker run -d --name defensia-agent --restart unless-stopped --privileged --net=host --pid=host -v /var/log:/var/log:ro -v /etc/defensia:/etc/defensia -e DEFENSIA_TOKEN=<TOKEN> ghcr.io/defensia/agent:latestGlobal service — 1 agent per node, one Organization API Key for all nodes
echo "<ORG_API_KEY>" | docker secret create defensia_api_key - && docker stack deploy -c docker-compose.swarm.yml defensiaHelm chart — DaemonSet on every node
helm install defensia-agent oci://ghcr.io/defensia/charts/defensia-agent --set apiKey=<ORG_API_KEY>Reads nginx-ingress and Traefik access logs — protects all cluster services automatically
Detects CrashLoopBackOff, OOMKilled, and ImagePullFailed events in real time
Identifies namespaces without NetworkPolicies and flags them as security risks
Auto-discovers exposed hostnames via the Kubernetes API
Read-only ClusterRole — the agent never modifies Kubernetes resources
Pricing: Free tier includes 1 node and 1 domain. Pro at €9/node includes up to 10 domains per node.
Works with popular server management panels
Native cPHulk SQLite integration, per-domain WAF via Apache domlogs, Postfix/Dovecot/FTP protection. WHM sidebar addon for one-click management.
curl -fsSL https://defensia.cloud/whm-addon/install.sh | bashFull support including journald fallback for EL8/EL9 systems. Works with CageFS, LVE, and all CloudLinux-specific environments.
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <TOKEN>Agent works on any Plesk server out of the box. Auto-detects Apache/Nginx logs and auth paths. Dedicated Plesk extension planned.
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <TOKEN>The agent auto-detects your panel environment, web server logs, and auth paths. cPanel WHM addon provides native sidebar integration. Plesk extension is under development.
Everything the agent needs to protect your server.
Native binaries for both major Linux architectures.
amd64
Most cloud VPS, dedicated servers, and Intel/AMD hardware. AWS EC2, DigitalOcean, Hetzner, Linode, Vultr.
arm64
AWS Graviton, Oracle Ampere, Hetzner CAX, Raspberry Pi 4/5, and Apple Silicon VMs.
One command. Works on all supported distributions. The installer auto-detects your OS, architecture, and auth log path.
curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <TOKEN>