Extending EDR to Linux Servers: Coverage Gaps and What Changes When You Switch
Is your Linux EDR really covering your servers? Check your coverage level, what changes when you switch EDR, and where EDR stops on Linux.
Let's say a pen test report arrives on a Monday. It lists three Linux servers with no working protection but your EDR dashboard shows all three as green.
Linux EDR coverage comes in levels, and a server can sit lower than its dashboard shows. To close the gap, check the real sensor mode on each server. Then extend your current tool, or switch to a new one with a staged rollout.
The trigger takes different forms. An insurer questionnaire asks for EDR on every server. An auditor samples a build server that you can't remember.
In the worst case, an attacker uses an unprotected Linux host as a foothold into the network. SentinelLabs documented one such case in March 2023. Attackers deployed a Linux version of IceFire ransomware against CentOS hosts that ran a vulnerable IBM Aspera Faspex.
Five Levels of Linux Endpoint Security, and Where Your Servers Sit
Endpoint security for Linux has five levels: no agent, antivirus only, EDR installed but degraded, full EDR, and full EDR with container and Kubernetes context. The sensor mode shows the level of each server. You check it with the vendor's own health command, on every host, and you record the result.
Level 1: No agent. Nothing records activity on the server. The attacker's first shell and every later step go unseen. You are at this level when a server is in your cloud inventory or CMDB but is missing from the EDR console.
Level 2: Antivirus only. A scanner compares files with known malware signatures. It misses hands-on activity that uses tools already on the host, such as bash, curl, cron and SSH. You are at this level when the server runs a scanner and sends no process telemetry to any console.
Level 3: EDR installed, degraded. The agent runs and reports, but it collects less telemetry than it should, or none. CrowdStrike documents that a Linux sensor in Reduced Functionality Mode processes no events and registers no detections, but it still sends heartbeats.
Microsoft documents a similar gap for its Netlink fallback, which captures no file system or socket events. You are at this level when the health command shows a reduced state.
Level 4: Full EDR. The sensor records process, file and network events. It raises detections and supports response actions. On Kubernetes nodes, it can miss pod and namespace context. You are at this level when the health command is clean and a test detection reaches the console.
Level 5: Full EDR with container context. Alerts from nodes include container IDs, pod names and namespaces, so you can trace each alert to one workload. You are at this level when node alerts show those fields.
Is Antivirus Enough for Linux Servers?
Antivirus for Linux has one clear job: it finds known malicious files. A Linux file server that stores files for Windows users needs that job, and ClamAV is the common open-source tool for it.
On an internet-facing or production server, Linux antivirus covers one stage of an attack. The intrusion itself uses legitimate binaries, and a signature scanner has no signal for them. EDR records the full process chain and alerts on the behavior.
I treat a Linux server antivirus deployment as Level 2. Then I plan the move to Level 4.
How Covered Are Your Linux Servers? Take the 5-Question Coverage Check
Answer five questions about your Linux estate. The check gives your likely coverage level and the top three gaps to close, in order. Each gap links to the section that tells you how to close it. The check reads only your answers, and it names no product.
Why Linux Coverage Drifts Behind Windows
Linux EDR depends on the kernel that the agent runs on. Distro kernel updates, custom kernels and long-lived servers can move a host off the vendor's supported list. The agent then drops to a reduced mode or a fallback event source, and the console often still shows the host as online.
On Windows, the vendor certifies a small set of OS builds. On Linux, each distro ships its own kernel stream, and each stream changes on its own schedule.
CrowdStrike states that new LTS kernels for supported distros are generally not compatible with the current sensor on release day. CrowdStrike adds support as fast as it can. No vendor I checked publishes a fixed number of days for this.
Kernel Module vs eBPF: How Linux EDR Sensors Work
A kernel module runs inside the kernel. It gives deep visibility, but the vendor must build it for each kernel, and a fault in it can crash the host.
An eBPF sensor loads small programs from user space, and the kernel verifier checks each program before it runs. This makes eBPF security agents less dependent on the exact kernel build. Here is what each vendor documents for Linux today:
- CrowdStrike Falcon: The sensor has a kernel mode (a kernel module) and a user mode (eBPF). The backend setting takes auto, bpf or kernel. From sensor 7.30 (October 2025), CrowdStrike removed the option to force kernel mode on hosts where user mode works.
- Microsoft Defender for Endpoint: Microsoft makes the eBPF sensor the default from agent version 101.23082.0006. Microsoft removed the auditd event provider in October 2024. When eBPF is unavailable, the agent falls back to Netlink and loses file system and socket events.
- SentinelOne: SentinelOne states that its Linux agent runs entirely in user space with eBPF probes and has no kernel modules.
eBPF lowers the risk of kernel faults. Kernel bugs can still reach it.
In April 2024, CrowdStrike blocked user mode on specific 6.x kernels after its engineers found a bug in the kernel BPF verifier. In June 2024, Red Hat warned customers about kernel panics on RHEL 9.4 hosts that ran the Falcon sensor. Red Hat's knowledge base links the panics to an eBPF program on kernels 5.14.0-410 and later.
Administrators on the Rocky Linux forum reported that a switch to kernel mode kept hosts stable on the new kernel. Microsoft documents similar eBPF known issues on RHEL 8.1 with SAP and on specific Oracle Linux 8.8 UEK kernels.
My rule is simple. I check every new kernel against the vendor's support list before that kernel reaches production. For a wider review of what your agents can see, audit your endpoint security stack.
What Is Reduced Functionality Mode, and How Do You Spot It?
Reduced Functionality Mode (RFM) is CrowdStrike's safe mode. On Linux, the sensor enters RFM when the host kernel is unsupported in kernel mode and fails the user mode requirements. In RFM, the sensor stops processing events and detections. It keeps sending heartbeats, so the host still looks present in the console.
Microsoft Defender for Endpoint and SentinelOne report sensor state through their own health commands. The switcher below gives the documented commands for each vendor and the result you want to see.
One trap catches many Microsoft shops. Microsoft documents that Defender for Servers deploys Defender for Endpoint on Linux with the antivirus component in passive mode.
EDR visibility stays on, and the agent blocks no malicious files. If Defender is your only antivirus, run the passive mode and real-time protection checks on every server.
Sensor mode is the first thing I check on any Linux fleet. The census script below records the distro, the kernel and the sensor state of each server in one CSV file. Run it from an admin host that has SSH access, and test it on one server first.
Servers Nobody Owns: Appliances, Build Servers and Long-Running VMs
The worst gaps sit on servers that never got an agent. Build servers, jump hosts, vendor appliances and old VMs often fall outside the standard image.
Find them with a set difference. Export the host list from your cloud accounts or CMDB, and export the host list from the EDR console. Convert both lists to lowercase short hostnames, then compare them with command 3 above.
For each host in uncovered.txt, record an owner, a decision and a date. Vendor appliances often prohibit third-party agents. For those hosts, send logs to your SIEM and restrict network access to the appliance.
Can Your Current EDR Cover Linux, or Should You Switch?
Extend your current EDR when the vendor supports your distros and kernels, reports sensor health clearly and licenses servers in a way you accept. Switch when one of those three conditions fails. Test each condition against your own census data and the vendor's written answers, server by server.
The table below collects what each vendor documents for Linux. Where a vendor keeps its Linux details behind a customer login, the cell says so. Ask for those details in writing before you sign.
Does Microsoft Defender for Endpoint Work on Linux?
Yes. Microsoft Defender for Endpoint on Linux runs as the mdatp agent on supported server distros. Desktop support in Microsoft Defender for Linux is in public preview. The agent uses an eBPF sensor and supports device isolation, antivirus scans and live response.
Each server needs a server license. Before you extend Defender to more Linux servers, verify passive mode and the event subsystem on every host.
Does CrowdStrike Support Linux?
Yes. The CrowdStrike Falcon sensor for Linux runs in user mode (eBPF) or in kernel mode. CrowdStrike also offers DaemonSet and container sensors for Kubernetes. If the kernel fails both modes, the sensor drops to RFM.
Before you extend Falcon, check the RFM state on every host and compare your kernels with the supported list. For platform background, read how CrowdStrike Falcon works.
SentinelOne on Linux: Agent, Kubernetes and Response Actions
The SentinelOne Linux agent runs in user space with eBPF probes, and SentinelOne states that it uses no kernel module. The Kubernetes agent deploys as a DaemonSet, one agent per node.
On Linux, SentinelOne documents kill, quarantine and a remote shell. It documents remediate for Windows and macOS only, and rollback for Windows only. Ask your account team which license covers servers and which covers clusters.
What Changes When You Switch EDR on Linux Servers
The agent install is the easy part of a switch. The real work is kernel compatibility, exclusion tuning, container coverage and a short period with two agents. Move each server through the eight steps below in order, and record the result of each step in your census file.
For step 4, Microsoft gives specific tools. Run sudo mdatp diagnostic ebpf-statistics to find the processes and paths that produce the most events. Then run mdatp exclusion list to review the current exclusions.
Microsoft states that exclusions applied to auditd cannot move to eBPF, so ask Microsoft for eBPF-level exclusions. For other vendors, ask for their written exclusion guidance for your database and backup software.
How to Stage Sensor Updates So One Release Can't Take Down the Fleet
I'd never push a new agent build to every production node on day one. Each vendor documents controls for staged updates:
- CrowdStrike sensor versions. Create a Linux sensor update policy for a canary host group, set to Auto - Early Adopter or Auto - Latest. Set production to Auto - N-1, and set critical systems to Auto - N-2.
- CrowdStrike content. CrowdStrike's content update policies offer Early Access, General Availability, General Availability + 4 hours, and Pause. Put canary hosts on Early Access and production on General Availability.
- Microsoft Defender for Endpoint. Install canary servers from the insiders-slow channel and production servers from the prod channel. A channel change needs a reinstall, so choose the channel at install time. To hold a version, use the Defender deployment tool's channel and version options.
- SentinelOne. Create auto-upgrade policies at the Account or Site scope. Confirm with SentinelOne that the policy applies to your Linux agents.
Set both sensor and content controls. In its root cause analysis of the July 19, 2024 Windows incident, CrowdStrike committed to staged deployment of content updates. It also committed to customer control over content deployment.
CISA's alert on that incident stated that it did not affect Linux hosts. The lesson still applies to Linux: a sensor version policy controls sensor builds only, and content updates need their own policy.
Running Two Agents During the Switch
Keep the overlap short and measured. Two agents hook the same kernel events, so watch CPU and I/O on the pilot hosts while both agents run.
Microsoft documents a coexistence mode for Linux: mdatp config passive-mode --value enabled. In passive mode, Defender keeps full EDR visibility and takes no remediation action. Use it when Defender arrives first or leaves last.
I found no public Linux coexistence guidance from CrowdStrike or SentinelOne, so ask each vendor in writing before the pilot. Our guide on switching from Defender to CrowdStrike covers the order of steps on the Windows side.
Licensing: Why Linux Servers Cost Differently From Laptops
Vendors license servers separately from workstations. Microsoft states that Defender for Endpoint Plan 1 and Plan 2 do not include server licenses. Servers need Defender for Servers Plan 1 or Plan 2, Defender for Endpoint for servers, or Defender for Business servers.
Microsoft states that both Defender for Servers plans include the capabilities of Defender for Endpoint Plan 2, and it recommends Plan 2 for most organizations.
Count Linux servers and Kubernetes nodes separately before you ask for a quote. For the wider Microsoft picture, read our Defender licensing analysis.
Where EDR Stops: CWPP, Container Runtime Security and Linux Logging
EDR covers the host. Cloud workload protection (CWPP) adds cloud posture checks and image scanning. Container runtime tools watch activity inside the cluster. auditd and log shipping feed the SIEM for audit and retention. Most Linux estates need EDR plus one or two of these tools, depending on where Linux runs.
Use the table to decide which layer each workload needs. One tool rarely covers all four layers, and two tools often overlap on the host layer.
Kubernetes runtime security is the layer I see skipped most often. A node agent records the process, but the alert is hard to act on without the pod and namespace. Close that gap with a container-aware EDR sensor, a runtime tool, or both.
Patch state matters too. A server on an old kernel drops off the vendor's support list, and the sensor degrades with it. Pair EDR with your patch and endpoint management tool, so kernel updates and sensor updates move on the same schedule.
Who Watches Linux Alerts at 3 AM?
A Linux alert at 3 AM needs a person who can isolate the host. If your team has no night shift, an MDR provider fills that gap through your EDR agent. Confirm in writing that the provider covers your Linux distros and can run response actions on Linux hosts.
Some providers publish their Linux scope. SentinelOne states that its Wayfinder MDR breach response warranty covers Windows, Linux, macOS and cloud workloads. Arctic Wolf lists broad Linux support for its endpoint product.
Ask every provider these four questions:
- Which Linux distros and kernels does your service support today?
- Which response actions can your analysts run on a Linux host: isolate, kill, quarantine or remote shell?
- Do you watch sensor mode, and do you alert us when a host drops to a degraded state?
- Do you cover Kubernetes nodes and containers, and under which license?
Compare the answers with our MDR providers compared guide. Then test the Linux path with a pilot drill from our guide on how to test an MDR provider before you sign.
Closing Thoughts
Check sensor mode before you buy anything. Run the census script, read the RFM state, the event subsystem or the connectivity status, and count the servers at each level. That count tells you if your current vendor can close the gap.
If it cannot, plan the switch around kernels, staged updates and a short overlap. Start this week with one step: run the census on ten servers and compare the result with your dashboard.
Closing a Linux coverage gap?
Explore EDR and MDR providers that cover every server you run. Tell us your distros, kernels and after-hours needs, and we'll match you with the vendors worth talking to. No vendor sees your details until you decide to talk. It's private and free.
FAQ
Does CrowdStrike support Linux?
Yes. The CrowdStrike Falcon sensor for Linux runs in user mode, which uses eBPF, or in kernel mode, which uses a kernel module. CrowdStrike also offers DaemonSet and container sensors for Kubernetes. If the host kernel fails both modes, the sensor enters Reduced Functionality Mode. Check each host with falconctl -g --rfm-state, and compare your kernels with the supported list in the Falcon documentation.
Does Microsoft Defender for Endpoint work on Linux?
Yes. Microsoft Defender for Endpoint on Linux runs as the mdatp agent on supported server distros, and Linux desktop support is in public preview. It uses an eBPF sensor and supports device isolation, antivirus scans and live response. Each server needs a server license, such as Defender for Servers. Run mdatp health to confirm that the sensor is healthy and that the event subsystem is ebpf.
What is CrowdStrike reduced functionality mode on Linux?
Reduced Functionality Mode (RFM) is a safe mode in the CrowdStrike Falcon sensor. On Linux, the sensor enters RFM when the host kernel is unsupported in kernel mode and fails the user mode requirements. In RFM, the sensor stops processing events and detections, but it still sends heartbeats, so the host looks present. Run falconctl -g --rfm-state and --rfm-reason, then upgrade the sensor or change the kernel.
Is antivirus enough for Linux servers?
Antivirus finds known malicious files, so it helps on Linux file servers that store files for Windows users. Attacks on Linux servers often use tools that already exist on the host, such as bash, curl, cron and SSH, and a signature scanner has no signal for that activity. EDR records the process chain and alerts on behavior. Use EDR on internet-facing and production Linux servers.
Does EDR on Linux use a kernel module or eBPF?
Both approaches exist, and the main vendors now use eBPF by default. Microsoft Defender for Endpoint uses an eBPF sensor by default. SentinelOne states that its Linux agent runs in user space with eBPF and has no kernel module. CrowdStrike supports both modes and defaults to user mode, which uses eBPF. eBPF lowers the risk of kernel crashes, and kernel bugs can still affect it.
Do I need separate security for Linux containers?
Often, yes. A host EDR agent on a Kubernetes node sees processes, but it can miss pod and namespace context. CrowdStrike and SentinelOne offer DaemonSet sensors that add container context, and their licenses can differ from server licenses. Container runtime tools such as Falco and CWPP platforms add cluster events, image scanning and cloud posture. Choose the layers by where your Linux workloads run.
Can MDR providers monitor Linux servers?
Yes. Many MDR providers monitor Linux servers through your EDR agent, but coverage differs by provider and tier. SentinelOne states that its Wayfinder MDR warranty covers Windows, Linux, macOS and cloud workloads. Ask each provider which distros it supports and which response actions its analysts can run on Linux. Also ask if the provider alerts you when a sensor drops to a degraded mode.
