diff --git a/pkg/driver/distro/distro_test.go b/pkg/driver/distro/distro_test.go
index 58eaaaf0..567adcf0 100644
--- a/pkg/driver/distro/distro_test.go
+++ b/pkg/driver/distro/distro_test.go
@@ -167,6 +167,28 @@ func TestDiscoverDistro(t *testing.T) {
 			distroExpected: &bottlerocket{},
 			errExpected:    false,
 		},
+		{
+			// os-release ID "ol" maps to oracle
+			krInput: "5.10.0-2047.510.5.5.el7uek.x86_64",
+			preFn: func() error {
+				type brCfg struct {
+					OsID string `ini:"ID"`
+				}
+				f := ini.Empty()
+				err := f.ReflectFrom(&brCfg{
+					OsID: "ol",
+				})
+				if err != nil {
+					return err
+				}
+				return f.SaveTo(osReleaseFile)
+			},
+			postFn: func() {
+				_ = os.Remove(osReleaseFile)
+			},
+			distroExpected: &ol{},
+			errExpected:    false,
+		},
 		{
 			// No os-release  but "centos-release" file present maps to centos
 			krInput: "5.10.0",
diff --git a/pkg/driver/distro/oracle.go b/pkg/driver/distro/oracle.go
new file mode 100644
index 00000000..5600236c
--- /dev/null
+++ b/pkg/driver/distro/oracle.go
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2024 The Falco Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package driverdistro
+
+import (
+	"strings"
+
+	"github.com/falcosecurity/driverkit/pkg/kernelrelease"
+
+	drivertype "github.com/falcosecurity/falcoctl/pkg/driver/type"
+)
+
+func init() {
+	distros["ol"] = &ol{generic: &generic{}}
+}
+
+type ol struct {
+	*generic
+}
+
+//nolint:gocritic // the method shall not be able to modify kr
+func (o *ol) PreferredDriver(kr kernelrelease.KernelRelease, allowedDriverTypes []drivertype.DriverType) drivertype.DriverType {
+	for _, allowedDrvType := range allowedDriverTypes {
+		// Skip dkms on UEK hosts because it will always fail
+		if allowedDrvType.String() == drivertype.TypeKmod && strings.Contains(kr.String(), "uek") {
+			continue
+		}
+		if allowedDrvType.Supported(kr) {
+			return allowedDrvType
+		}
+	}
+	return nil
+}