Prior to installing the sensor, the underlying BPF implementation requires the Linux 4.4 kernel headers for the active kernel to be installed. However, some lower kernels are still supported without BPF integration, for the full list, please see Linux Sensor Support.
Kernel headers are required for both Endpoint Standard and Enterprise EDR functionality
Kernel headers must remain present after install
Should the kernel be updated, the kernel headers should be updated as well
In cases where kernel headers cannot be found via public repo the install command will fail, and the headers may have been removed by the vendor. Consider updating the kernel or finding an alternative source of the kernel headers for manual installation.