Linux Sensor Processes and Paths

Overview

This document provides the complete list of Linux Sensor processes and paths that should be excluded from EDR tools and other security applications.

Sensor Processes

The Cyberhaven Linux Sensor includes the following process:

Process Name	Description
/opt/cyberhaven/cyberhaven	The top-level directory that contains all the process files related to Cyberhaven.

The Sensor periodically monitors its health and sends its status, the endpoint system information, and the event metadata to the Cyberhaven backend.

Sensor Paths

A Linux device running Cyberhaven will have application and log files stored in the following directories:

Directory	Purpose
/opt/cyberhaven	Main application directory
/var/log/cyberhaven.log	Primary log file
/var/log/cyberhaven_bpf.log	BPF-related log file
/etc/opt/cyberhaven	Configuration directory
/var/lib/cyberhaven	Data directory