You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Servers](/azure/defender-for-cloud/integration-defender-for-endpoint)
29
29
30
-
Before you begin: Install unzip if it's not already installed.
30
+
## Introduction
31
31
32
-
The Chef components are already installed and a Chef repository exists (chef generate repo \<reponame\>) to store the cookbook that's used to deploy to Defender for Endpoint on Chef managed Linux servers.
32
+
This article talks about how to deploy Defender for Endpoint on Linux at scale with Chef using two methods:
33
33
34
-
You can create a new cookbook in your existing repository by running the following command from inside the cookbooks folder that is in your chef repository:
34
+
1. Install using installer script
35
+
2. Manually configuring the repositories for more granular control over the deployment
36
+
37
+
## Prerequisites
38
+
39
+
For a description of prerequisites and system requirements, see [Microsoft Defender for Endpoint on Linux](/defender-endpoint/microsoft-defender-endpoint-linux).
40
+
41
+
## Download the onboarding package
42
+
43
+
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/) then navigate to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
44
+
45
+
2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method.
46
+
47
+
3. Select **Download onboarding package** and save the file as `WindowsDefenderATPOnboardingPackage.zip`.
48
+
49
+
50
+
51
+
4. Extract the contents of the archive using the following command:
52
+
53
+
Command:
54
+
55
+
```
56
+
unzip WindowsDefenderATPOnboardingPackage.zip
57
+
```
58
+
59
+
The expected output is:
60
+
61
+
```
62
+
Archive: WindowsDefenderATPOnboardingPackage.zip
63
+
inflating: mdatp_onboard.json
64
+
```
65
+
66
+
## Create a directory structure
67
+
68
+
Before you begin, ensure the Chef components are already installed and a Chef repository (chef generate repo <reponame>) exists to store the cookbook that's used to deploy to Defender for Endpoint on Chef-managed Linux servers.
69
+
70
+
The following command creates a new folder structure for the new cookbook called **mdatp**. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
35
71
36
72
```bash
37
73
chef generate cookbook mdatp
38
74
```
39
75
40
-
This command creates a new folder structure for the new cookbook called mdatp. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
41
-
After the cookbook is created, create a files folder inside the cookbook folder that just got created:
76
+
After the cookbook is created, create a files folder inside the cookbook folder that you created:
42
77
43
78
```bash
44
79
mkdir mdatp/files
45
80
```
46
81
47
-
Transfer the Linux Server Onboarding zip file that can be downloaded from the Microsoft Defender portal to this new files folder.
48
-
49
-
[!INCLUDE [Defender for Endpoint repackaging warning](../includes/repackaging-warning.md)]
82
+
Copy `mdatp_onboard.json` to the `/tmp` folder.
50
83
51
-
On the Chef Workstation, navigate to the mdatp/recipes folder. This folder is created when the cookbook was generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the default.rb file:
84
+
On the Chef Workstation, navigate to the **mdatp/recipes** folder, which is automatically created when the cookbook is generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the **default.rb** file then save and close the file:
52
85
53
-
- include_recipe '::onboard_mdatp'
54
86
- include_recipe '::install_mdatp'
55
87
56
-
Then save and close the default.rb file.
88
+
## Create a cookbook
89
+
90
+
A cookbook can be created through any of the following methods:
91
+
92
+
-[Using an installer script](linux-deploy-defender-for-endpoint-with-chef.md#create-a-cookbook-using-installer-script)
1. Download the installer bash script. Pull the [installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh) from Microsoft GitHub Repository or use the following command to download it:
2. Create a new recipe file named **install_mdatp.rb** in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [GitHub](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_simplified.rb).
104
+
105
+
```bash
106
+
mdatp = "/etc/opt/microsoft/mdatp"
107
+
108
+
#Download the onboarding json from tenant, keep the same at specific location
109
+
onboarding_json = "/tmp/mdatp_onboard.json"
110
+
111
+
#Download the installer script from: https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh
112
+
#Place the same at specific location, edit this if needed
> The installer script also supports other parameters such as channel, realtime protection, version, etc. To selectfrom the list of available options, check help through the following command:
127
+
>```./mde_installer.sh --help```
57
128
58
-
Next create a new recipe file named install_mdatp.rb in the recipes folder and add this text to the file:
129
+
### Create a cookbook by manually configuring repositories
130
+
131
+
Create a new recipe file named **install_mdatp.rb**in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [Github](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_manual.rb).
59
132
60
133
```powershell
61
134
#Add Microsoft Defender
62
-
Repo
63
135
case node['platform_family']
64
136
when 'debian'
65
-
apt_repository 'MDAPRepo' do
137
+
apt_repository 'MDATPRepo'do
66
138
arch 'amd64'
67
139
cache_rebuild true
68
140
cookbook false
69
141
deb_src false
70
142
key 'BC528686B50D79E339D3721CEB3E94ADBE1229CF'
71
143
keyserver "keyserver.ubuntu.com"
72
-
distribution 'focal'
144
+
distribution 'jammy'
73
145
repo_name 'microsoft-prod'
74
146
components ['main']
75
-
trusted true
76
-
uri "https://packages.microsoft.com/config/ubuntu/20.04/prod"
147
+
uri "https://packages.microsoft.com/ubuntu/22.04/prod"
Make sure to update the path name to the location of the onboarding file.
121
-
To test deploy it on the Chef workstation, run ``sudo chef-client -z -o mdatp``.
122
-
After your deployment, you should consider creating and deploying a configuration file to the servers based on [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md).
123
-
After creating and testing your configuration file, you can put it into the `cookbook/mdatp/files` folder where you also placed the onboarding package. Then you can create a settings_mdatp.rb file in the mdatp/recipies folder and add this text:
124
-
125
-
```powershell
126
-
#Copy the configuration file
127
-
cookbook_file '/etc/opt/microsoft/mdatp/managed/mdatp_managed.json' do
To include this step as part of the recipe just add `include_recipe ':: settings_mdatp` to your default.rb file within the recipe folder.
186
+
>[!NOTE]
187
+
> You can modify the os distribution, distribution version number, channel (prod/insider-fast, insiders-slow) and repo name to match the version you're deploying to and the channel you'd like to deploy to. Run `chef-client --local-mode --runlist 'recipe[mdatp]'` to test the cookbook on the Chef workstation.
188
+
189
+
## Troubleshoot installation issues
190
+
191
+
To troubleshoot issues:
137
192
138
-
You can also use crontab to schedule automatic updates [Schedule an update for Microsoft Defender for Endpoint on Linux](linux-update-MDE-Linux.md).
193
+
1. For information on how to find the log that's generated automatically when an installation error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
139
194
140
-
Uninstall MDATP cookbook:
195
+
2. For information about common installation issues, see [Installation issues](/defender-endpoint/linux-support-install).
196
+
197
+
3. If the health of the device is `false`, see [Defender for Endpoint agent health issues](/defender-endpoint/health-status).
198
+
199
+
4. For product performance issues, see [Troubleshoot performance issues](/defender-endpoint/linux-support-perf).
200
+
201
+
5. For proxy and connectivity issues, see [Troubleshoot cloud connectivity issues](/defender-endpoint/linux-support-connectivity).
202
+
203
+
To get support from Microsoft, open a support ticket, and provide the log files created by using the [client analyzer](/defender-endpoint/run-analyzer-macos-linux).
204
+
205
+
## How to configure policies for Microsoft Defender on Linux
206
+
207
+
You can configure antivirus or EDR settings on your endpoints using any of the following methods:
208
+
209
+
- See [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
210
+
- See [security settings management](/mem/intune/protect/mde-security-integration) to configure settings in the Microsoft Defender portal.
211
+
212
+
## Uninstall MDATP cookbook
213
+
214
+
To uninstall Defender, save the following as a cookbook `~/cookbooks/mdatp/recipes/uninstall_mdatp.rb`.
141
215
142
216
```powershell
143
217
#Uninstall the Defender package
@@ -159,4 +233,7 @@ then
159
233
end
160
234
end
161
235
```
236
+
237
+
To include this step as part of the recipe, add `include_recipe ':: uninstall_mdatp` to your `default.rb` file within the recipe folder. Ensure that you have removed the `include_recipe '::install_mdatp'` from the `default.rb` file.
238
+
162
239
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
0 commit comments