Skip to content

Commit 32f82cf

Browse files
committed
Merge branch 'main' into pr/2276
2 parents 7e4e175 + 4bc621e commit 32f82cf

File tree

7 files changed

+212
-36
lines changed

7 files changed

+212
-36
lines changed

defender-endpoint/behavior-monitor-macos.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.author: deniseb
66
manager: deniseb
77
ms.service: defender-endpoint
88
ms.topic: overview
9-
ms.date: 12/11/2024
9+
ms.date: 01/02/2025
1010
ms.subservice: ngp
1111
audience: ITPro
1212
ms.collection:
@@ -278,13 +278,14 @@ NRI should have a low impact on network performance. Instead of holding the conn
278278

279279
1. Enable network real-time inspection (NRI):
280280

281-
```Bash
281+
```Bash
282282

283283
sudo mdatp network-protection remote-settings-override set --value "{\"enableNriMpengineMetadata\" : true}"
284284

285285

286286
```
287287

288288
> [!NOTE]
289-
> While in Public Preview, since the setting is set via a command line, network real-time inspection (NRI) will not persist reboots. You will need to re-enable it.
289+
> While this feature is in preview, and because the setting is set by using command line, network real-time inspection (NRI) doesn't persist following reboots. You must re-enable it.
290+
290291

defender-endpoint/microsoft-defender-endpoint-linux.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
ms.topic: conceptual
1616
ms.subservice: linux
1717
search.appverid: met150
18-
ms.date: 12/24/2024
18+
ms.date: 01/02/2025
1919
---
2020

2121
# Microsoft Defender for Endpoint on Linux
@@ -59,7 +59,7 @@ Microsoft Defender for Endpoint for Linux includes anti-malware and endpoint det
5959
> [!NOTE]
6060
> Performance tuning might be needed based on workloads. See [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](linux-support-perf.md).
6161
62-
- The following Linux server distributions and x64 (AMD64/EM64T) and x86_64 versions are supported:
62+
- The following Linux server distributions and x64 (AMD64/EM64T) versions are supported:
6363
- Red Hat Enterprise Linux 7.2 or higher
6464
- Red Hat Enterprise Linux 8.x
6565
- Red Hat Enterprise Linux 9.x

defender-endpoint/onboard-windows-client.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.collection:
1313
ms.topic: conceptual
1414
ms.subservice: onboard
1515
search.appverid: met150
16-
ms.date: 04/03/2024
16+
ms.date: 12/31/2024
1717
---
1818

1919
# Defender for Endpoint onboarding Windows client devices
@@ -30,7 +30,7 @@ ms.date: 04/03/2024
3030

3131
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https:%2F%2Faka.ms%2FMDEp2OpenTrial)
3232
33-
To onboard Windows client devices, follow the onboarding steps in the [Microsoft Defender portal](https://security.microsoft.com) (Go to **Settings** > **Endpoints** > **Onboarding**). You can onboard any of the supported devices. Depending on the particular device, you're guided ny appropriate steps and are provided with management and deployment tool options suitable for the device.
33+
To onboard Windows client devices, follow the onboarding steps in the [Microsoft Defender portal](https://security.microsoft.com) (Go to **Settings** > **Endpoints** > **Onboarding**). You can onboard any of the supported devices. Depending on the particular device, you're guided with the appropriate steps according to the management and deployment tool options suitable for the device.
3434

3535
Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. In general, you identify the client you're onboarding, then follow the corresponding tool appropriate to the device or your environment.
3636

defender-endpoint/run-analyzer-macos-linux.md

Lines changed: 195 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -158,37 +158,168 @@ If you're using a terminal, download the tool by entering the following command:
158158
159159
## Command line options
160160
161-
### Primary command lines
162-
163-
Use the following command to get the machine diagnostic.
161+
### All command line options
164162
165163
```console
166-
-h, --help show this help message and exit
167-
--output OUTPUT, -o OUTPUT
168-
Output path to export report
169-
--outdir OUTDIR Directory where diagnostics file will be generated
170-
--no-zip, -nz If set a directory will be created instead of an archive file
171-
--force, -f Will overwrite if output directory exists
172-
--diagnostic, -d Collect extensive machine diagnostic information
173-
--bypass-disclaimer Do not display disclaimer banner
174-
--interactive, -i Interactive diagnostic
175-
--delay DELAY, -dd DELAY
176-
Set MDATP log level. If you use interactive or delay mode, the log level will set to debug automatically, and reset after 48h.
177-
--mdatp-log {info,debug,verbose,error,trace,warning}
178-
Set MDATP log level
179-
--max-log-size MAX_LOG_SIZE
180-
Maximum log file size in MB before rotating(Will restart mdatp)
164+
usage: MDESupportTool [-h] [--output OUTPUT] [--outdir OUTDIR] [--no-zip]
165+
[--force] [--diagnostic] [--skip-mdatp]
166+
[--bypass-disclaimer] [--interactive] [--delay DELAY]
167+
[--mdatp-log {trace,info,warning,error,debug,verbose}]
168+
[--max-log-size MAX_LOG_SIZE]
169+
{certinfocollection,performance,installation,exclude,ratelimit,skipfaultyrules,trace,observespikes,connectivitytest}
170+
...
171+
172+
MDE Diagnostics Tool
173+
174+
positional arguments:
175+
{certinfocollection,performance,installation,exclude,ratelimit,skipfaultyrules,trace,observespikes,connectivitytest}
176+
certinfocollection Collect cert information: Subject name and Hashes
177+
performance Collect extensive machine performance tracing for
178+
analysis of a performance scenario that can be
179+
reproduced on demand
180+
installation Collect different installation/onboarding reports
181+
exclude Exclude specific process(es) from audit-d monitoring.
182+
ratelimit Set the rate limit for auditd events. Rate limit will
183+
update the limits for auditd events for all the
184+
applications using auditd, which could impact
185+
applications other than MDE.
186+
skipfaultyrules Continue loading rules in spite of an error. This
187+
summarizes the results of loading the rules. The exit
188+
code will not be success if any rule fails to load.
189+
trace Use OS tracing facilities to record Defender
190+
performance traces.
191+
observespikes Collect the process logs in case of spike or mdatp
192+
crash
193+
connectivitytest Perform connectivity test for MDE
194+
195+
optional arguments:
196+
-h, --help show this help message and exit
197+
--output OUTPUT, -o OUTPUT
198+
Output path to export report
199+
--outdir OUTDIR Directory where diagnostics file will be generated.
200+
--no-zip, -nz If set a directory will be created instead of an
201+
archive file.
202+
--force, -f Will overwrite if output directory exists.
203+
--diagnostic, -d Collect extensive machine diagnostic information.
204+
--skip-mdatp Skip any mdatp command. Use this when the mdatp
205+
command is unresponsive.
206+
--bypass-disclaimer Do not display disclaimer banner.
207+
--interactive, -i Interactive diagnostic,
208+
--delay DELAY, -dd DELAY
209+
Delay diagnostic by how many minutes (0~2880), use
210+
this to wait for more debug logs before it collects.
211+
--mdatp-log {trace,info,warning,error,debug,verbose}
212+
Set MDATP log level. If you use interactive or delay
213+
mode, the log level will set to debug automatically,
214+
and reset after 48h.
215+
--max-log-size MAX_LOG_SIZE
216+
Maximum log file size in MB before rotating(Will
217+
restart mdatp).
181218
```
182219
220+
### Diagnostics mode
221+
222+
This is used to collected etensive set of machine information, such as memory, disk, MDATP logs, etc.
223+
These set of files give us primary set of information required to debug any issue related to MDE.
224+
225+
The options supported for this is:
226+
```console
227+
optional arguments:
228+
-h, --help show this help message and exit
229+
--output OUTPUT, -o OUTPUT
230+
Output path to export report
231+
--outdir OUTDIR Directory where diagnostics file will be generated.
232+
--no-zip, -nz If set a directory will be created instead of an
233+
archive file.
234+
--force, -f Will overwrite if output directory exists.
235+
--diagnostic, -d Collect extensive machine diagnostic information.
236+
--skip-mdatp Skip any mdatp command. Use this when the mdatp
237+
command is unresponsive.
238+
--bypass-disclaimer Do not display disclaimer banner.
239+
--interactive, -i Interactive diagnostic,
240+
--delay DELAY, -dd DELAY
241+
Delay diagnostic by how many minutes (0~2880), use
242+
this to wait for more debug logs before it collects.
243+
--mdatp-log {trace,info,warning,error,debug,verbose}
244+
Set MDATP log level. If you use interactive or delay
245+
mode, the log level will set to debug automatically,
246+
and reset after 48h.
247+
--max-log-size MAX_LOG_SIZE
248+
Maximum log file size in MB before rotating(Will
249+
restart mdatp).
250+
```
183251
Usage example: `sudo ./MDESupportTool -d`
184252
185253
NOTE: The log level auto-reset feature only available in 2405 or newer client version.
186254
255+
The files generated when using this mode:
256+
| File | Remarks |
257+
| ------------- | ------------- |
258+
| mde_diagnostic.zip | MDE logs and configs |
259+
| health.txt | The health status of MDE [^1] |
260+
| health_details_features.txt | The health status of additional MDE features [^1] |
261+
| permissions.txt | Permission issues with the folders owned/used by MDE [^1] |
262+
| crashes | Crash dumps generated by MDE |
263+
| process_information.txt | Process running in the machine when the tool was run |
264+
| proc_directory_info.txt | Mapping of the virtual memory of MDE processes [^1] |
265+
| auditd_info.txt | Auditd health, rules, logs |
266+
| auditd_log_analysis.txt | Summary of events processed by auditd |
267+
| auditd_logs.zip | Auditd log files |
268+
| ebpf_kernel_config.txt | Currently loaded Linux Kernel config |
269+
| ebpf_enabled_func.txt | List of --------- |
270+
| ebpf_syscalls.zip | Information about system call tracing |
271+
| ebpf_raw_syscalls.zip | Tracing events related to raw system calls |
272+
| ebpf_maps_info.txt | eBPF maps' id and size info |
273+
| syslog.zip | The files usder /var/log/syslog |
274+
| messages.zip | The files under /var/log/messages |
275+
| conflicting_processes_information.txt | MDE Conflicting Processes |
276+
| exclusions.txt | List of AV exclusions |
277+
| definitions.txt | AV defintion info |
278+
| mde_directories.txt | List of files in the MDE directories |
279+
| disk_usage.txt | Disk usage details |
280+
| mde_user.txt | MDE User Info |
281+
| mde_definitions_mount.txt | MDE Definitions Mount Point |
282+
| service_status.txt | MDE Service Status |
283+
| service_file.txt | MDE Service File |
284+
| hardware_info.txt | Hardware Information |
285+
| mount.txt | Mount point information |
286+
| uname.txt | Kernel info |
287+
| memory.txt | System memory info |
288+
| meminfo.txt | Detailed information about the system's memory usage |
289+
| cpuinfo.txt | CPU Information |
290+
| lsns_info.txt | Linux namespace information |
291+
| lsof.txt | MDE Open File Descriptors Information [^1] |
292+
| sestatus.txt | MDE Open File Descriptors Information |
293+
| lsmod.txt | Status of modules in the Linux kernel |
294+
| dmesg.txt | Messages from the kernel ring buffer |
295+
| kernel_lockdown.txt | kernel lockdown Info |
296+
| rtp_statistics.txt | MDE Real Time Protection(RTP) statistics [^1] |
297+
| libc_info.txt | libc library information |
298+
| uptime_info.txt | Time since last restart |
299+
| last_info.txt | Listing of last logged in users |
300+
| locale_info.txt | Show current locale |
301+
| tmp_files_owned_by_mdatp.txt | /tmp files owned by group:mdatp [^1] |
302+
| mdatp_config.txt | All the MDE configurations [^1] |
303+
| mpenginedb.db, mpenginedb.db-wal, mpenginedb.db-shm | AV definations file [^1] |
304+
| iptables_rules.txt | Linux iptables rules |
305+
| network_info.txt | Network information |
306+
| sysctl_info.txt | kernel settings info |
307+
| hostname_diagnostics.txt | Hostname diagnostics information |
308+
| mde_event_statistics.txt | MDE Event statistics [^1] |
309+
| mde_ebpf_statistics.txt | MDE eBPF statistics [^1] |
310+
| kernel_logs.zip | Kernel logs |
311+
| mdc_log.zip | Microsoft Defender for Cloud logs |
312+
| netext_config.txt | |
313+
| threat_list.txt | List of threats detected by MDE [^1] |
314+
| top_output.txt | Process running in the machine when the tool was run |
315+
| top_summary.txt | Memeory and CPU usage analytics of the process running |
316+
[^1]: Only when MDE is installed.
317+
187318
### Positional arguments
188319
189320
#### Collect performance info
190321
191-
Collect extensive machine performance tracing for analysis of a performance scenario that can be reproduced on demand.
322+
Collect extensive machine performance tracing of MDE processes for analysis of a performance scenario that can be reproduced on demand.
192323
193324
```console
194325
-h, --help show this help message and exit
@@ -197,7 +328,51 @@ Collect extensive machine performance tracing for analysis of a performance scen
197328
--length LENGTH length of time to collect (in seconds)
198329
```
199330
200-
Usage example: `sudo ./MDESupportTool performance --frequency 2`
331+
Usage example: `sudo ./MDESupportTool performance --frequency 500`
332+
333+
The files generated when using this mode:
334+
| File | Remarks |
335+
| ------------- | ------------- |
336+
| perf_benchmark.tar.gz | MDE processes performance data |
337+
> [!NOTE]
338+
> The files corresponding to diagnostic mode will also be generated.
339+
340+
The tar files contains files on the format `<pid of a MDE process>.data`.
341+
The data file can be read using the command:
342+
343+
`perf report -i <pid>.data`
344+
345+
#### Run connectivity test
346+
This modes test if the cloud resources needed by MDE is reachable or not.
347+
348+
```console
349+
-h, --help show this help message and exit
350+
-o ONBOARDING_SCRIPT, --onboarding-script ONBOARDING_SCRIPT
351+
Path to onboarding script
352+
-g GEO, --geo GEO Geo string to test <US|UK|EU|AU|CH|IN>
353+
```
354+
Usage example: `sudo ./MDESupportTool connectivitytest -o ~/MicrosoftDefenderATPOnboardingLinuxServer.py`
355+
356+
The result will be printed in the screen.
357+
358+
359+
#### Collect different installation/onboarding reports
360+
This mode collects installation related info like disto info, system requirements, etc.
361+
362+
```console
363+
-h, --help show this help message and exit
364+
-d, --distro Check for distro support
365+
-a, --all Run all checks
366+
```
367+
368+
Usage example: `sudo ./MDESupportTool installation --all`
369+
370+
A single report `installation_report.json` will be generated. The keys in the file are as:
371+
| Key | Remarks |
372+
| ------------- | ------------- |
373+
| agent_version | Version of MDE installed |
374+
| onboarding_status | The onboarding and ring info |
375+
201376
202377
#### Use OS trace (for macOS only)
203378

defender-xdr/microsoft-sentinel-onboard.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,10 @@ To connect a Microsoft Sentinel workspace to the Defender portal, complete the f
8787
1. Choose the workspace you want to connect and select **Next**.
8888
1. Read and understand the product changes associated with connecting your workspace. These changes include:
8989

90+
- Incidents are no longer created by Microsoft Sentinel. They're now created by the correlation engine in the Microsoft Defender portal. This change is reflected in the incident's "incident provider name" field, which now reads "Microsoft Defender XDR."
91+
- Therefore, any active [Microsoft security incident creation rules](/azure/sentinel/threat-detection#microsoft-security-rules) are deactivated to avoid creating duplicate incidents. The incident creation settings in other types of analytics rules remain as they were, but those settings are implemented in the Defender portal, not in Microsoft Sentinel.
9092
- Log tables, queries, and functions in the Microsoft Sentinel workspace are also available in advanced hunting within the Defender portal.
9193
- The Microsoft Sentinel Contributor role is assigned to the Microsoft Threat Protection and WindowsDefenderATP apps within the subscription.
92-
- Active [Microsoft security incident creation rules](/azure/sentinel/threat-detection#microsoft-security-rules) are deactivated to avoid duplicate incidents. This change only applies to incident creation rules for Microsoft alerts and not to other analytics rules.
9394
- All alerts related to Defender XDR products are streamed directly from the main Defender XDR data connector to ensure consistency. Make sure you have incidents and alerts from this connector turned on in the workspace.
9495

9596
1. Select **Connect**.

defender-xdr/mto-tenantgroups.md

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,17 @@ ms.localizationpriority: medium
88
manager: deniseb
99
audience: ITPro
1010
ms.collection:
11-
- m365-security
12-
- highpri
13-
- tier1
11+
- m365-security
12+
- highpri
13+
- tier1
1414
ms.topic: conceptual
15-
ms.date: 11/20/2024
15+
ms.date: 01/02/2025
1616
appliesto:
17-
- ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a>
17+
- ✅ <a href="https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a>
1818
---
1919

2020
# Content distribution in multitenant management
2121

22-
[!INCLUDE [Prerelease](../includes/prerelease.md)]
23-
2422
Content distribution helps you manage content at scale, across tenants in multitenant management in Microsoft Defender XDR. In content distribution, you can create tenant groups to copy existing content, like custom detection rules, from the source tenant to the target tenants you assign during tenant group creation. The content then runs on the target tenant's devices or device groups that you set in the tenant group scope.
2523

2624
Distributing content in this manner, across tenants, enables you to organize tenants and content based on categories like business groups or location.

0 commit comments

Comments
 (0)