Skip to content

Commit 2f6c8a0

Browse files
Merge pull request #2735 from yujiaoMSFT/docs-editor/linux-installer-script-1739346986
Update linux-installer-script.md
2 parents 0fa6ee7 + dc7191b commit 2f6c8a0

File tree

1 file changed

+34
-26
lines changed

1 file changed

+34
-26
lines changed

defender-endpoint/linux-installer-script.md

Lines changed: 34 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
5050

5151
4. Select **Download onboarding package**. Save the file as `WindowsDefenderATPOnboardingPackage.zip`.
5252

53-
:::image type="content" source="media/linux-script-image.png" alt-text="Screenshot showing the options to select to download the onboarding package." lightbox="media/linux-script-image.png":::
53+
:::image type="content" source="media/linux-script-image.png" alt-text="Screenshot showing the options to select to download the onboarding package." lightbox="media/linux-script-image.png":::
5454

5555
5. From a command prompt, extract the contents of the archive:
5656

@@ -77,19 +77,19 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
7777
chmod +x mde_installer.sh
7878
```
7979
80-
4. Execute the installer script and provide the onboarding package as a parameter to install the agent and onboard the device to the Defender portal.
80+
1. Execute the installer script and provide the onboarding package as a parameter to install the agent and onboard the device to the Defender portal.
8181
8282
```bash
83-
84-
sudo ./mde_installer.sh --install --onboard ~/MicrosoftDefenderATPOnboardingLinuxServer.py --channel prod --min_req -y
85-
83+
84+
sudo ./mde_installer.sh --install --onboard ./MicrosoftDefenderATPOnboardingLinuxServer.py --channel prod --min_req
85+
8686
```
87+
88+
This command deploys the latest agent version to the production channel, check for min system requisites and onboard the device to Defender Portal.
8789
88-
This command deploys the latest agent version to the production channel, check for min system requisites and onboard the device to Defender Portal.
89-
90-
Additionally you can pass more parameter based on your requirements to modify the installation. Check help for all the available options:
90+
Additionally you can pass more parameter based on your requirements to modify the installation. Check help for all the available options:
9191
92-
```bash
92+
```bash
9393
9494
❯ ./mde_installer.sh --help
9595
mde_installer.sh v0.7.0
@@ -108,7 +108,7 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
108108
-m|--min_req enforce minimum requirements
109109
-x|--skip_conflict skip conflicting application verification
110110
-w|--clean remove repo from package manager for a specific channel
111-
-y|--yes assume yes for all mid-process prompts (default, depracated)
111+
-y|--yes assume yes for all mid-process prompts (default, deprecated)
112112
-n|--no remove assume yes sign
113113
-s|--verbose verbose output
114114
-v|--version print out script version
@@ -124,19 +124,19 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
124124
125125
| Scenario | Command |
126126
|---|---|
127-
| Install a specific agent version | `sudo ~/mde_installer.sh --install --channel prod --onboard ~/MicrosoftDefenderATPOnboardingLinuxServer.py --min_req -y –-mdatp 101.24082.0004 ` |
128-
| To upgrade to the latest version | `sudo ~/mde_installer.sh --upgrade -y` |
129-
| For upgrading to a specific version | `sudo ~/mde_installer.sh --upgrade -y –-mdatp 101.24082.0004` |
130-
| To downgrade to a specific version | `sudo ~/mde_installer.sh --downgrade -y –-mdatp 101.24082.0004` |
131-
| To remove `mdatp` | `sudo ~/mde_installer.sh --remove -y` |
132-
133-
134-
> [!NOTE]
135-
> Upgrading your operating system to a new major version after the product installation requires the product to be reinstalled. You need to uninstall the existing Defender for Endpoint on Linux, upgrade the operating system, and then reconfigure Defender for Endpoint on Linux.
127+
|Install a specific agent version | `sudo ./mde_installer.sh --install --channel prod --onboard ./MicrosoftDefenderATPOnboardingLinuxServer.py --min_req –-mdatp 101.24082.0004 ` |
128+
|Upgrade to the latest agent version | `sudo ./mde_installer.sh --upgrade` |
129+
|Upgrade to a specific agent version | `sudo ./mde_installer.sh --upgrade –-mdatp 101.24082.0004` |
130+
|Downgrade to a specific agent version | `sudo ./mde_installer.sh --downgrade –-mdatp 101.24082.0004` |
131+
|Uninstall agent | `sudo ./mde_installer.sh --remove` |
132+
133+
134+
> [!NOTE]
135+
> Upgrading your operating system to a new major version after the product installation requires the product to be reinstalled. You need to uninstall the existing Defender for Endpoint on Linux, upgrade the operating system, and then reconfigure Defender for Endpoint on Linux.
136136
137137
## Verify deployment status
138138
139-
1. In the [Microsoft Defender portal](https://security.microsoft.com), open the device inventory. It might take 5-20 mins for the device to show up in the portal.
139+
1. In the [Microsoft Defender portal](https://security.microsoft.com), open the device inventory. It might take 5-20 minutes for the device to show up in the portal.
140140
141141
2. Run an antivirus detection test to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
142142
@@ -170,14 +170,22 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
170170
mdatp threat list
171171
```
172172

173-
3. Run an EDR detection test and simulate a detection to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
173+
1. Run an EDR detection test and simulate a detection to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
174174

175-
1. Verify that the onboarded Linux server appears in the Microsoft Defender portal. If this is the first onboarding of the machine, it can take up to 20 minutes until it appears.
176-
177-
2. Download and extract the [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server, and run the following command:
178-
179-
`./mde_linux_edr_diy.sh`
175+
1. Download and extract the [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server.
176+
177+
1. Grant executable permissions to the script:
180178

179+
```bash
180+
chmod +x mde_linux_edr_diy.sh
181+
```
182+
183+
1. Run the following command:
184+
185+
```bash
186+
./mde_linux_edr_diy.sh
187+
```
188+
181189
3. After a few minutes, a detection should be raised in the Microsoft Defender XDR.
182190

183191
4. Check the alert details, machine timeline, and perform your typical investigation steps.

0 commit comments

Comments
 (0)