You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-installer-script.md
+34-26Lines changed: 34 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,7 +50,7 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
50
50
51
51
4. Select **Download onboarding package**. Save the file as `WindowsDefenderATPOnboardingPackage.zip`.
52
52
53
-
:::image type="content" source="media/linux-script-image.png" alt-text="Screenshot showing the options to select to download the onboarding package." lightbox="media/linux-script-image.png":::
53
+
:::image type="content" source="media/linux-script-image.png" alt-text="Screenshot showing the options to select to download the onboarding package." lightbox="media/linux-script-image.png":::
54
54
55
55
5. From a command prompt, extract the contents of the archive:
56
56
@@ -77,19 +77,19 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
77
77
chmod +x mde_installer.sh
78
78
```
79
79
80
-
4. Execute the installer script and provide the onboarding package as a parameter to install the agent and onboard the device to the Defender portal.
80
+
1. Execute the installer script and provide the onboarding package as a parameter to install the agent and onboard the device to the Defender portal.
-w|--clean remove repo from package manager for a specific channel
111
-
-y|--yes assume yes for all mid-process prompts (default, depracated)
111
+
-y|--yes assume yes for all mid-process prompts (default, deprecated)
112
112
-n|--no remove assume yes sign
113
113
-s|--verbose verbose output
114
114
-v|--version print out script version
@@ -124,19 +124,19 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
124
124
125
125
| Scenario | Command |
126
126
|---|---|
127
-
|Install a specific agent version | `sudo ~/mde_installer.sh --install --channel prod --onboard ~/MicrosoftDefenderATPOnboardingLinuxServer.py --min_req -y –-mdatp 101.24082.0004 ` |
128
-
| To upgrade to the latest version | `sudo ~/mde_installer.sh --upgrade -y` |
129
-
| For upgrading to a specific version | `sudo ~/mde_installer.sh --upgrade -y –-mdatp 101.24082.0004` |
130
-
| To downgrade to a specific version | `sudo ~/mde_installer.sh --downgrade -y –-mdatp 101.24082.0004` |
131
-
| To remove `mdatp` | `sudo ~/mde_installer.sh --remove -y` |
132
-
133
-
134
-
> [!NOTE]
135
-
> Upgrading your operating system to a new major version after the product installation requires the product to be reinstalled. You need to uninstall the existing Defender for Endpoint on Linux, upgrade the operating system, and then reconfigure Defender for Endpoint on Linux.
127
+
|Install a specific agent version | `sudo ./mde_installer.sh --install --channel prod --onboard ./MicrosoftDefenderATPOnboardingLinuxServer.py --min_req –-mdatp 101.24082.0004 ` |
128
+
|Upgrade to the latest agent version | `sudo ./mde_installer.sh --upgrade` |
129
+
|Upgrade to a specific agent version | `sudo ./mde_installer.sh --upgrade –-mdatp 101.24082.0004` |
130
+
|Downgrade to a specific agent version | `sudo ./mde_installer.sh --downgrade –-mdatp 101.24082.0004` |
> Upgrading your operating system to a new major version after the product installation requires the product to be reinstalled. You need to uninstall the existing Defender for Endpoint on Linux, upgrade the operating system, and then reconfigure Defender for Endpoint on Linux.
136
136
137
137
## Verify deployment status
138
138
139
-
1. In the [Microsoft Defender portal](https://security.microsoft.com), open the device inventory. It might take 5-20 mins for the device to show up in the portal.
139
+
1. In the [Microsoft Defender portal](https://security.microsoft.com), open the device inventory. It might take 5-20 minutes for the device to show up in the portal.
140
140
141
141
2. Run an antivirus detection test to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
142
142
@@ -170,14 +170,22 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
170
170
mdatp threat list
171
171
```
172
172
173
-
3. Run an EDR detection test and simulate a detection to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
173
+
1. Run an EDR detection test and simulate a detection to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
174
174
175
-
1. Verify that the onboarded Linux server appears in the Microsoft Defender portal. If this is the first onboarding of the machine, it can take up to 20 minutes until it appears.
176
-
177
-
2. Download and extract the [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server, and run the following command:
178
-
179
-
`./mde_linux_edr_diy.sh`
175
+
1. Download and extract the [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server.
176
+
177
+
1. Grant executable permissions to the script:
180
178
179
+
```bash
180
+
chmod +x mde_linux_edr_diy.sh
181
+
```
182
+
183
+
1. Run the following command:
184
+
185
+
```bash
186
+
./mde_linux_edr_diy.sh
187
+
```
188
+
181
189
3. After a few minutes, a detection should be raised in the Microsoft Defender XDR.
182
190
183
191
4. Check the alert details, machine timeline, and perform your typical investigation steps.
0 commit comments