Sandfly by Sandfly Security is an agentless Linux security monitoring platform designed to protect a wide range of Linux systems. It operates without installing endpoint agents, allowing for instant deployment across various Linux distributions and architectures including AMD, Intel, Arm, MIPS, and POWER CPUs. Sandfly focuses on threat detection, compromise detection, intrusion tactics hunting, SSH key monitoring, and asset tracking specifically for Linux environments. It can be deployed in cloud, on-premises, embedded devices, and legacy systems over a decade old. The platform uses SSH for connectivity and supports authentication via username/password, public/private keys, and SSH key certificates. Sandfly utilizes containerized architecture and can be set up quickly, requiring minimal system resources for operation.
