You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-whatsnew.md
+35-22Lines changed: 35 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: deniseb
6
6
author: denisebmsft
7
7
ms.reviewer: kumasumit, gopkr
8
8
ms.localizationpriority: medium
9
-
ms.date: 12/02/2024
9
+
ms.date: 01/09/2025
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -30,13 +30,10 @@ search.appverid: met150
30
30
31
31
This article is updated frequently to let you know what's new in the latest releases of Microsoft Defender for Endpoint on Linux.
32
32
33
-
-[What's new in Defender for Endpoint on macOS](mac-whatsnew.md)
34
-
-[What's new in Defender for Endpoint on iOS](ios-whatsnew.md)
35
-
36
33
> [!IMPORTANT]
37
-
> Starting with version `101.2408.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology. This change allows for better performance, reduced resource consumption, and overall improved stability. eBPF support has been available since August 2023, and is fully integrated into all updates of Defender for Endpoint on Linux (version `101.23082.0006` and later). We strongly encourage you to adopt the eBPF build, as it provides significant enhancements over Auditd. If eBPF is not supported on your machines, or if there are specific requirements to remain on Auditd, you have the following options:
34
+
> Starting with version `101.24082.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology. This change allows for better performance, reduced resource consumption, and overall improved stability. eBPF support has been available since August 2023, and is fully integrated into all updates of Defender for Endpoint on Linux (version `101.23082.0006` and later). We strongly encourage you to adopt the eBPF build, as it provides significant enhancements over Auditd. If eBPF isn't supported on your machines, or if there are specific requirements to remain on Auditd, you have the following options:
38
35
>
39
-
> 1. Continue to use Defender for Endpoint on Linux build `101.24072.0000` with Auditd. This build will continue to be supported for several months, so you have time to plan and execute your migration to eBPF.
36
+
> 1. Continue to use Defender for Endpoint on Linux build `101.24072.0000` with Auditd. This build continues to be supported for several months, so you have time to plan and execute your migration to eBPF.
40
37
>
41
38
> 2. If you are on versions later than `101.24072.0000`, Defender for Endpoint on Linux relies on `netlink` as a backup supplementary event provider. In the event of a fallback, all process operations continue to flow seamlessly.
42
39
>
@@ -46,6 +43,22 @@ This article is updated frequently to let you know what's new in the latest rele
@@ -58,9 +71,9 @@ This article is updated frequently to let you know what's new in the latest rele
58
71
59
72
#### What's new
60
73
61
-
-Support added for hardened installations on non-executable`/var` partitions. Beginning with this release, antivirus signatures are installed at `/opt/microsoft/mdatp/definitions.noindex`by default, instead of `/var/opt/microsoft/mdatp/definitions.noindex`. During upgrades, the installer attempts to migrate older definitions to the new path unless it detects that the path is already customized (using `mdatp definitions path set`).
74
+
-To support hardened installations with nonexecutable`/var` partitions, mdatp antivirus definitions will now install to `/opt/microsoft/mdatp/definitions.noindex` instead of `/var` if the latter is detected as nonexecutable. During upgrades, the installer attempts to migrate older definitions to the new path upon detecting a nonexecutable `/var`, unless it finds that the path has already been customized (using `mdatp definitions path set`).
62
75
63
-
- Beginning with this version, Defender for Endpoint on Linux no longer needs executable permissions for `/var/log`. If these permissions are not available, log files are automatically be redirected to `/opt`.
76
+
- Beginning with this version, Defender for Endpoint on Linux no longer needs executable permissions for `/var/log`. If these permissions aren't available, log files are automatically redirected to `/opt`.
@@ -74,7 +87,7 @@ This article is updated frequently to let you know what's new in the latest rele
74
87
75
88
#### What's new
76
89
77
-
- Starting this version, Defender for Endpoint on Linux no longer supports `AuditD` as a supplementary event provider. For improved stability and performance, we have completely transitioned to eBPF. If you disable eBPF, or in the event eBPF is not supported on any specific kernel, Defender for Endpoint on Linux automatically switches back to Netlink as a fallback supplementary event provider. Netlink provides reduced functionality and tracks only process-related events. In this case, all process operations continue to flow seamlessly, but you could miss specific file and socket-related events that eBPF would otherwise capture. For more details, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md). If you have any concerns or need assistance during this transition, contact support.
90
+
- Starting this version, Defender for Endpoint on Linux no longer supports `AuditD` as a supplementary event provider. For improved stability and performance, we have transitioned to eBPF. If you disable eBPF, or in the event eBPF isn't supported on any specific kernel, Defender for Endpoint on Linux automatically switches back to Netlink as a fallback supplementary event provider. Netlink provides reduced functionality and tracks only process-related events. In this case, all process operations continue to flow seamlessly, but you could miss specific file and socket-related events that eBPF would otherwise capture. For more information, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md). If you have any concerns or need assistance during this transition, contact support.
78
91
- Stability and performance improvements
79
92
- Other bug fixes
80
93
@@ -107,10 +120,10 @@ This article is updated frequently to let you know what's new in the latest rele
107
120
108
121
There are multiple fixes and new changes in this release.
109
122
110
-
- Fixes bug in which infected command-line threat information was not showing correctly in security portal.
123
+
- Fixes bug in which infected command-line threat information wasn't showing correctly in security portal.
111
124
- Fixes a bug where disabling a preview feature required a Defender of Endpoint to disable it.
112
125
- Global Exclusions feature using managed JSON is now in Public Preview. available in insiders slow from 101.23092.0012. For more information, see [linux-exclusions](linux-exclusions.md).
113
-
- Updated the Linux default engine version to 1.1.24050.7 and default sigs Version to 1.411.410.0.
126
+
- Updated the Linux default engine version to 1.1.24050.7 and default signature version to 1.411.410.0.
114
127
- Stability and performance improvements.
115
128
- Other bug fixes.
116
129
@@ -128,7 +141,7 @@ There are multiple fixes and new changes in this release.
128
141
129
142
There are multiple fixes and new changes in this release.
130
143
131
-
- This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only impacted the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Please update to the latest MDE version to avoid any impact.
144
+
- This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only impacted the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Update to the latest MDE version to avoid any impact.
132
145
- We have now simplified the output of `mdatp health --detail features`
133
146
- Stability and performance improvements.
134
147
- Other bug fixes.
@@ -165,7 +178,7 @@ There are multiple fixes and new changes in this release:
165
178
166
179
There are multiple fixes and new changes in this release:
167
180
168
-
- In passive and on-demand modes, antivirus engine remains in idle state and is used only during scheduled custom scans. Thus as part of performance improvements, we have made changes to keep the AV engine down in passive and on-demand mode except during scheduled custom scans. If the real time protection is enabled, antivirus engine will always be up and running. This will have no impact on your server protection in any mode.
181
+
- In passive and on-demand modes, antivirus engine remains in idle state and is used only during scheduled custom scans. Thus as part of performance improvements, we have made changes to keep the AV engine down in passive and on-demand mode except during scheduled custom scans. If the real time protection is enabled, antivirus engine will always be up and running. This has no impact on your server protection in any mode.
169
182
170
183
To keep users informed of the state of antivirus engine, we have introduced a new field called "engine_load_status" as part of MDATP health. It indicates whether antivirus engine is currently running or not.
171
184
@@ -205,7 +218,7 @@ There are multiple fixes and new changes in this release:
205
218
206
219
There are multiple fixes and new changes in this release:
207
220
208
-
- The addition of a new log file - `microsoft_defender_scan_skip.log`. This will log the filenames that were skipped from various antivirus scans by Microsoft Defender for Endpoint due to any reason.
221
+
- The addition of a new log file - `microsoft_defender_scan_skip.log`. This logs the filenames that were skipped from various antivirus scans by Microsoft Defender for Endpoint due to any reason.
209
222
- Stability and performance improvements.
210
223
- Bug fixes.
211
224
@@ -254,14 +267,14 @@ There are multiple fixes and new changes in this release:
254
267
| Alma 8.4 and higher | Insiders Slow |https://packages.microsoft.com/config/alma/8/insiders-slow.repo|
255
268
| Alma 9.2 and higher | Insiders Slow |https://packages.microsoft.com/config/alma/9/insiders-slow.repo|
256
269
257
-
If you already have Defender for Endpoint running on any of these distros and facing any issues in the older versions, please upgrade to the latest Defender for Endpoint version from the corresponding ring mentioned above. Refer our [public deployment docs](comprehensive-guidance-on-linux-deployment.md) for more details.
270
+
If you already have Defender for Endpoint running on any of these distros and facing any issues in the older versions, upgrade to the latest Defender for Endpoint version from the corresponding ring mentioned above. Refer our [public deployment docs](comprehensive-guidance-on-linux-deployment.md) for more details.
258
271
259
272
> [!NOTE]
260
273
> Known issues:
261
274
>
262
275
> Microsoft Defender for Endpoint for Linux on Rocky and Alma currently has the following known issues:
263
276
> - Live Response and Threat Vulnerability Management are currently not supported (work in progress).
264
-
> - Operating system info for devices is not visible in the Microsoft Defender portal
277
+
> - Operating system info for devices isn't visible in the Microsoft Defender portal
@@ -319,7 +332,7 @@ There are multiple fixes and new changes in this release:
319
332
```
320
333
- Starting with this release, Microsoft Defender for Endpoint on Linux will no longer be shipping a solution for RHEL 6.
321
334
322
-
RHEL 6 'Extended end of life support' is poised to end by June 30, 2024 and customers are advised to plan their RHEL upgrades accordingly aligned with guidance from Red Hat. Customers who need to run Defender for Endpoint on RHEL 6 servers can continue to leverage version 101.23082.0011 (does not expire before June 30, 2024) supported on kernel versions 2.6.32-754.49.1.el6.x86_64 or prior.
335
+
RHEL 6 'Extended end of life support' is poised to end by June 30, 2024 and customers are advised to plan their RHEL upgrades accordingly aligned with guidance from Red Hat. Customers who need to run Defender for Endpoint on RHEL 6 servers can continue to use version 101.23082.0011 (doesn't expire before June 30, 2024) supported on kernel versions 2.6.32-754.49.1.el6.x86_64 or prior.
323
336
- Engine Update to `1.1.23080.2007` and Signatures Ver: `1.395.1560.0`.
324
337
- Streamlined device connectivity experience is now in public preview mode. [public blog](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-a-streamlined-device-connectivity-experience-for/ba-p/3956236)
325
338
- Performance improvements & bug fixes.
@@ -342,7 +355,7 @@ There are multiple fixes and new changes in this release:
342
355
343
356
This new release is build over October 2023 release (101.23082.0009) with addition of following changes. There's no change for other customers and upgrading is optional.
344
357
345
-
Fix for immutable mode of auditd when supplementary subsystem is ebpf: In ebpf mode all mdatp audit rules should be cleaned after switching to ebpf and rebooting. After reboot, mdatp audit rules were not cleaned due to which it was resulting in hang of the server. The fix cleans these rules, user should not see any mdatp rules loaded on reboot
358
+
Fix for immutable mode of auditd when supplementary subsystem is ebpf: In ebpf mode all mdatp audit rules should be cleaned after switching to ebpf and rebooting. After reboot, mdatp audit rules weren't cleaned due to which it was resulting in hang of the server. The fix cleans these rules, user shouldn't see any mdatp rules loaded on reboot
346
359
347
360
Fix for MDE not starting up on RHEL 6.
348
361
@@ -427,7 +440,7 @@ sudo systemctl disable mdatp
427
440
- You must add "*.dm.microsoft.com" to firewall exclusions for the feature to work correctly
428
441
- Defender for Endpoint is now available for Debian 12 and Amazon Linux 2023
429
442
- Support to enable Signature verification of updates downloaded
430
-
-Note that you must update the manajed.json as shown below
443
+
-You must update the manajed.json as shown below
431
444
```
432
445
"features":{
433
446
"OfflineDefinitionUpdateVerifySig":"enabled"
@@ -632,7 +645,7 @@ sudo systemctl disable mdatp
632
645
- There are multiple fixes and new changes in this release
633
646
- Improved Network Protection Proxy handling.
634
647
- In Passive mode, Defender for Endpoint no longer scans when Definition update happens.
635
-
- Devices continue to be protected even after Defender for Endpoint agent has expired. We recommend upgrading the Defender for Endpoint Linux agent to the latest available version to receive bug fixes, features and performance improvements.
648
+
- Devices continue to be protected even after Defender for Endpoint agent has expired. We recommend upgrading the Defender for Endpoint Linux agent to the latest available version to receive bug fixes, features, and performance improvements.
636
649
- Removed semanage package dependency.
637
650
- Engine Update to `1.1.20100.7` and Signatures Ver: `1.385.1648.0`.
638
651
- Bug fixes.
@@ -884,7 +897,7 @@ sudo systemctl disable mdatp
884
897
- Fixes an issue with accessing SMB shares behind Cisco AnyConnect VPN connections.
885
898
- Fixes an issue with Network Protection and SMB.
886
899
- lttng performance tracing support.
887
-
- TVM, eBPF, auditd, telemetry and mdatp cli improvements.
900
+
- TVM, eBPF, auditd, telemetry, and mdatp cli improvements.
888
901
- mdatp health now reports behavior_monitoring
889
902
- Other fixes.
890
903
@@ -1039,7 +1052,7 @@ As an alternative approach, follow the instructions to [uninstall](linux-resourc
1039
1052
#### What's new
1040
1053
1041
1054
- Added an option to [configure file hash computation](linux-preferences.md#configure-file-hash-computation-feature)
1042
-
- From this build onwards, the product has the new antimalware engine by default
1055
+
- From this build onwards, the product has the new anti-malware engine by default
1043
1056
- Performance improvements for file copy operations
0 commit comments