Skip to content

Commit 51ce9f9

Browse files
padmagit77padmagit77
authored
Merge branch 'main' into patch-3
2 parents 849aa83 + fc87932 commit 51ce9f9

File tree

5 files changed

+390
-0
lines changed

5 files changed

+390
-0
lines changed

‎defender-endpoint/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,8 @@
255255
items:
256256
- name: Deploy Defender for Endpoint on Linux
257257
items:
258+
- name: Defender for Endpoint on Linux for ARM64-based devices (preview)
259+
href: mde-linux-arm.md
258260
- name: Puppet based deployment
259261
href: linux-install-with-puppet.md
260262
- name: Ansible based deployment

‎defender-endpoint/mde-linux-arm.md‎

Lines changed: 388 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,388 @@
1+
---
2+
title: Microsoft Defender for Endpoint on Linux for ARM64-based devices (preview)
3+
description: Defender for Endpoint on Linux now supports ARM devices. Learn how it works and how to deploy it.
4+
author: denisebmsft
5+
ms.author: deniseb
6+
manager: deniseb
7+
ms.date: 12/09/2024
8+
ms.topic: how-to
9+
ms.service: defender-endpoint
10+
ms.subservice: linux
11+
ms.localizationpriority: medium
12+
ms.collection:
13+
- m365-security
14+
- tier3
15+
- mde-linux
16+
ms.custom:
17+
- partner-contribution
18+
ms.reviewer: meghapriya
19+
search.appverid: MET150
20+
f1.keywords: NOCSH
21+
audience: ITPro
22+
ai-usage: human-only
23+
---
24+
25+
# Microsoft Defender for Endpoint on Linux for ARM64-based devices (preview)
26+
27+
## Overview of Defender for Endpoint on Linux for ARM64-based devices
28+
29+
As you might already know, [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md) is a unified endpoint security solution that helps you protect your server devices from advanced threats. Defender for Endpoint on Linux is now extending support for ARM64-based Linux servers in preview. Similar to x64-based Linux servers (including Intel and AMD 64-bit platform), the following capabilities are included:
30+
31+
- Microsoft Defender Antivirus
32+
- Endpoint detection and response (EDR)
33+
- Live response
34+
- Device isolation
35+
- Advanced hunting
36+
- Vulnerability management
37+
- Centralized policy configuration using security settings management
38+
39+
Initially, the following Linux distributions are supported in preview:
40+
41+
- Ubuntu 20.04 ARM64
42+
- Ubuntu 22.04 ARM64
43+
- Amazon Linux 2 ARM64
44+
- Amazon Linux 2023 ARM64
45+
46+
> [!NOTE]
47+
> Support for more Linux distributions is planned as part of this preview program.
48+
49+
The installation procedures in this article install the agent version `101.24102.0002` from the insiders-slow channel on the ARM64-based device. (See [What's new in Microsoft Defender for Endpoint on Linux](linux-whatsnew.md).)
50+
51+
## Deploy Defender for Endpoint on Linux for ARM64-based devices
52+
53+
You can choose from several methods to deploy Defender for Endpoint on Linux to your ARM64-based device:
54+
55+
- [Installer script](#deploy-using-the-installer-script)
56+
- [Ansible](#deploy-using-the-installer-script-with-ansible)
57+
- [Puppet](#deploy-using-the-installer-script-with-puppet)
58+
- [Microsoft Defender for Cloud](#deploy-defender-for-endpoint-on-linux-using-microsoft-defender-for-cloud)
59+
60+
### Before you begin
61+
62+
- Make sure the [prerequisites](microsoft-defender-endpoint-linux.md#prerequisites) are met for Defender for Endpoint on Linux
63+
64+
- To onboard servers to Defender for Endpoint, [server licenses](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-defender-for-endpoint) are required. You can choose from these options:
65+
66+
- Microsoft Defender for Servers Plan 1 or Plan 2 (as part of the [Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction)) offering; or
67+
- Microsoft Defender for Endpoint Server
68+
69+
### Deploy using the installer script
70+
71+
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
72+
73+
2. In the onboarding screen, select the following options:
74+
75+
:::image type="content" source="media/mde-linux-arm-installerscript.png" alt-text="Screenshot showing MDE onboarding using installer script.":::
76+
77+
1. In the **Select operating system to start onboarding process** list, select **Linux Server**.
78+
79+
2. In the **Connectivity type** list, select **Streamlined**. Or, if necessary, you can select **Standard**. (For more information, see [Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint](configure-device-connectivity.md).)
80+
81+
3. In the **Deployment method** list, select **Local Script (Python)**.
82+
83+
4. Select **Download onboarding package**.
84+
85+
3. In a new browser window, download the [Defender for Endpoint installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh).
86+
87+
4. Use the following command to grant the necessary permissions for the script:
88+
89+
`$chmod +x /mde_installer.sh`
90+
91+
5. Run the following command to execute the installer script:
92+
93+
`$sudo ~/mde_installer.sh --install --channel insiders-slow --onboard ~/MicrosoftDefenderATPOnboardingLinuxServer.py`
94+
95+
6. Validate the deployment by following these steps:
96+
97+
1. On the device, run the following command to check the health status. A return value of `true` denotes that the product is functioning as expected:
98+
99+
`$ mdatp health --field healthy`
100+
101+
2. In the [Microsoft Defender portal](https://security.microsoft.com), under **Assets** > **Devices**, look for the Linux device you just onboarded. It can take approximately 20 minutes for the device to show up in the portal.
102+
103+
7. If you run into an issue, see [Troubleshoot deployment issues](#troubleshoot-deployment-issues) (in this article).
104+
105+
### Deploy using the installer script with Ansible
106+
107+
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
108+
109+
2. In the onboarding screen, select the following options:
110+
111+
:::image type="content" source="media/mde-linux-arm-ansible.png" alt-text="Screenshot showing MDE onboarding screen to use Ansible.":::
112+
113+
1. In the **Select operating system to start onboarding process** list, select **Linux Server**.
114+
115+
2. In the **Connectivity type** list, select **Streamlined**. Or, if necessary, you can select **Standard**. (For more information, see [Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint](configure-device-connectivity.md).)
116+
117+
3. In the **Deployment method** list, select **Your preferred Linux configuration management tool**.
118+
119+
4. Select **Download onboarding package**.
120+
121+
3. In a new browser window, download the [Defender for Endpoint installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh).
122+
123+
4. Create an installation YAML file on your Ansible server. For example, `/etc/ansible/playbooks/install_mdatp.yml`, using the `mde_installer.sh` you downloaded in step 3.
124+
125+
```yml
126+
127+
name: Install and Onboard MDE
128+
hosts: servers
129+
tasks:
130+
- name: Create a directory if it does not exist
131+
ansible.builtin.file:
132+
path: /tmp/mde_install
133+
state: directory
134+
mode: '0755'
135+
136+
- name: Copy Onboarding script
137+
ansible.builtin.copy:
138+
src: "{{ onboarding_script }}"
139+
dest: /tmp/mde_install/mdatp_onboard.json
140+
- name: Install MDE on host
141+
ansible.builtin.script: "{{ mde_installer_script }} --install --channel {{ channel | default('insiders-slow') }} --onboard /tmp/mde_install/mdatp_onboard.json"
142+
register: script_output
143+
args:
144+
executable: sudo
145+
146+
- name: Display the installation output
147+
debug:
148+
msg: "Return code [{{ script_output.rc }}] {{ script_output.stdout }}"
149+
150+
- name: Display any installation errors
151+
debug:
152+
msg: "{{ script_output.stderr }}"
153+
154+
```
155+
156+
5. Deploy Defender for Endpoint on Linux by using the following command. Edit the corresponding paths and channel, as appropriate.
157+
158+
```bash
159+
160+
ansible-playbook -i /etc/ansible/hosts /etc/ansible/playbooks/install_mdatp.yml --extra-vars "onboarding_script=<path to mdatp_onboard.json > mde_installer_script=<path to mde_installer.sh> channel=<channel to deploy for: insiders-slow > "
161+
162+
```
163+
164+
6. Validate your deployment by following these steps:
165+
166+
1. On the device, run the following commands to check for device health, connectivity, antivirus, and EDR detections:
167+
168+
```YAML
169+
170+
- name: Run post-installation basic MDE test
171+
hosts: myhosts
172+
tasks:
173+
174+
- name: Check health
175+
ansible.builtin.command: mdatp health --field healthy
176+
register: health_status
177+
178+
- name: MDE health test failed
179+
fail: msg="MDE is not healthy. health status => \n{{ health_status.stdout }}\nMDE deployment not complete"
180+
when: health_status.stdout != "true"
181+
182+
- name: Run connectivity test
183+
ansible.builtin.command: mdatp connectivity test
184+
register: connectivity_status
185+
186+
- name: Connectivity failed
187+
fail: msg="Connectivity failed. Connectivity result => \n{{ connectivity_status.stdout }}\n MDE deployment not complete"
188+
when: connectivity_status.rc != 0
189+
190+
- name: Check RTP status
191+
ansible.builtin.command: mdatp health --field real_time_protection_enabled
192+
register: rtp_status
193+
194+
- name: Enable RTP
195+
ansible.builtin.command: mdatp config real-time-protection --value enabled
196+
become: yes
197+
become_user: root
198+
when: rtp_status.stdout != "true"
199+
200+
- name: Pause for 5 second to enable RTP
201+
ansible.builtin.pause:
202+
seconds: 5
203+
204+
- name: Download EICAR
205+
ansible.builtin.get_url:
206+
url: https://secure.eicar.org/eicar.com.txt
207+
dest: /tmp/eicar.com.txt
208+
209+
- name: Pause for 5 second to detect eicar
210+
ansible.builtin.pause:
211+
seconds: 5
212+
213+
- name: Check for EICAR file
214+
stat: path=/tmp/eicar.com.txt
215+
register: eicar_test
216+
217+
- name: EICAR test failed
218+
fail: msg="EICAR file not deleted. MDE deployment not complete"
219+
when: eicar_test.stat.exists
220+
221+
- name: MDE Deployed
222+
debug:
223+
msg: "MDE succesfully deployed"
224+
225+
```
226+
227+
2. In the [Microsoft Defender portal](https://security.microsoft.com), under **Assets** > **Devices**, look for the Linux device you just onboarded. It can take approximately 20 minutes for the device to show up in the portal.
228+
229+
7. If you run into an issue, see [Troubleshoot deployment issues](#troubleshoot-deployment-issues) (in this article).
230+
231+
### Deploy using the installer script with Puppet
232+
233+
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
234+
235+
2. In the onboarding screen, select the following options:
236+
237+
:::image type="content" source="media/mde-linux-arm-puppet.png" alt-text="Screenshot showing the onboarding screen in MDE for Puppet.":::
238+
239+
1. In the **Select operating system to start onboarding process** list, select **Linux Server**.
240+
241+
2. In the **Connectivity type** list, select **Streamlined**. Or, if necessary, you can select **Standard**. (For more information, see [Onboarding devices using streamlined connectivity for Microsoft Defender for Endpoint](configure-device-connectivity.md).)
242+
243+
3. In the **Deployment method** list, select **Your preferred Linux configuration management tool**.
244+
245+
4. Select **Download onboarding package**. Save the file as `WindowsDefenderATPOnboardingPackage.zip`.
246+
247+
3. Extract the contents of the onboarding package by using the following command:
248+
249+
`unzip WindowsDefenderATPOnboardingPackage.zip`
250+
251+
You should see the following output:
252+
253+
```
254+
Archive: WindowsDefenderATPOnboardingPackage.zip
255+
inflating: mdatp_onboard.json
256+
```
257+
258+
4. In a new browser window, download the [Defender for Endpoint installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh) (this script is called `mde_installer.sh`).
259+
260+
5. Create a Puppet manifest by using the following procedure, which uses the `mde_installer.sh` script from step 4.
261+
262+
1. In the **modules** folder of your Puppet installation, create the following folders:
263+
264+
- `install_mdatp/files`
265+
- `install_mdatp/manifests`
266+
267+
The **modules** folder is typically located at `/etc/puppetlabs/code/environments/production/modules` on your Puppet server.
268+
269+
2. Copy the `mdatp_onboard.json` file created earlier to the `install_mdatp/files` folder.
270+
271+
3. Copy `mde_installer.sh` to `install_mdatp/files folder`.
272+
273+
4. Create an `init.pp` file inside `install_mdatp/manifests` that contains the following deployment instructions:
274+
275+
```bash
276+
tree install_mdatp
277+
Output:
278+
install_mdatp
279+
├── files
280+
│ ├── mdatp_onboard.sh
281+
│ └── mde_installer.sh
282+
└── manifests
283+
└── init.pp
284+
```
285+
286+
6. Use the Puppet manifest to install Defender for Endpoint on Linux on your device.
287+
288+
```bash
289+
290+
# Puppet manifest to install Microsoft Defender for Endpoint on Linux.
291+
# @param channel The release channel based on your environment, insider-fast or prod.
292+
293+
class install_mdatp (
294+
$channel = 'insiders-slow',
295+
) {
296+
# Ensure that the directory /tmp/mde_install exists
297+
file { '/tmp/mde_install':
298+
ensure => directory,
299+
mode => '0755',
300+
}
301+
302+
# Copy the installation script to the destination
303+
file { '/tmp/mde_install/mde_installer.sh':
304+
ensure => file,
305+
source => 'puppet:///modules/install_mdatp/mde_installer.sh',
306+
mode => '0777',
307+
}
308+
309+
# Copy the onboarding script to the destination
310+
file { '/tmp/mde_install/mdatp_onboard.json':
311+
ensure => file,
312+
source => 'puppet:///modules/install_mdatp/mdatp_onboard.json',
313+
mode => '0777',
314+
}
315+
316+
#Install MDE on the host using an external script
317+
exec { 'install_mde':
318+
command => "/tmp/mde_install/mde_installer.sh --install --channel ${channel} --onboard /tmp/mde_install/mdatp_onboard.json",
319+
path => '/bin:/usr/bin',
320+
user => 'root',
321+
logoutput => true,
322+
require => File['/tmp/mde_install/mde_installer.sh', '/tmp/mde_install/mdatp_onboard.json'], # Ensure the script is copied before running the installer
323+
}
324+
}
325+
```
326+
327+
7. Validate your deployment. In the [Microsoft Defender portal](https://security.microsoft.com), under **Assets** > **Devices**, look for the Linux device you just onboarded. It can take approximately 20 minutes for the device to show up in the portal.
328+
329+
### Deploy Defender for Endpoint on Linux using Microsoft Defender for Cloud
330+
331+
If your organization is using Defender for Cloud, you can use it to deploy Defender for Endpoint on Linux.
332+
333+
1. We recommend enabling automatic deployment on your ARM64-based Linux devices. After VM provisioning, define a variable under the file `/etc/mde.arm.d/mde.conf` on your device as follows:
334+
335+
`OPT_FOR_MDE_ARM_PREVIEW=1`
336+
337+
2. Wait for 1-6 hours for onboarding to complete.
338+
339+
3. In the [Microsoft Defender portal](https://security.microsoft.com), under **Assets** > **Devices**, look for the Linux devices you just onboarded.
340+
341+
**Need help with Defender for Cloud?**
342+
343+
See these articles:
344+
345+
- [Enable the Defender for Endpoint integration: Linux](/azure/defender-for-cloud/enable-defender-for-endpoint#linux)
346+
- [Connect your non-Azure machines to Microsoft Defender for Cloud: Onboard your Linux server](/azure/defender-for-cloud/quickstart-onboard-machines#onboard-your-linux-server)
347+
348+
349+
## Troubleshoot deployment issues
350+
351+
If you run into any issues deploying Defender for Endpoint on Linux to your ARM64-based devices, help is available. First, review our list of common issues and how to resolve them. If the problem persists, contact us.
352+
353+
### Common issues and how to resolve them
354+
355+
The following table summarizes common issues and how to resolve them.
356+
357+
| Error message or issue | What to do |
358+
|--|--|
359+
| `mdatp not found` | The repository might not be configured correctly. Check to see if the channel is set to `insiders-slow` in the installer script |
360+
| `mdatp health` indicates a missing license | Make sure you're passing the correct onboarding script or json file to your automation script or tool |
361+
| Exclusions aren't working as expected | If you had exclusions working on other devices, but they're not working on your ARM64-based Linux servers, contact us at `[email protected]`. You need your client analyzer logs. |
362+
| You want help with tuning mdatp. | Contact us at `[email protected]`. |
363+
364+
### Contact us if you need help
365+
366+
When you contact us at `[email protected]`, make sure to describe the issue in detail. Include screenshots if possible, and your client analyzer logs.
367+
368+
### XMDE Client Analyzer ARM Preview
369+
370+
1. Using Bash, download the [XMDE Client Analyzer ARM Preview](https://go.microsoft.com/fwlink/?linkid=2299668).
371+
372+
```bash
373+
wget --quiet -O XMDEClientAnalyzerARMPreview.zip https://go.microsoft.com/fwlink/?linkid=2299668
374+
```
375+
2. Run the support tool.
376+
377+
```bash
378+
sudo ./MDESupportTool -d --mdatp-log debug
379+
```
380+
3. Follow the on-screen instructions and then follow up with at the end of the log collection. The logs are located in the `/tmp` directory.
381+
382+
The log set is owned by the root user, so you might need root privileges to remove the log set.
383+
384+
## See also
385+
386+
- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
387+
388+
- [Supported Microsoft Defender for Endpoint capabilities by platform](supported-capabilities-by-platform.md)

‎defender-endpoint/media/mde-linux-arm-ansible.png‎

59.3 KB
Loading

‎defender-endpoint/media/mde-linux-arm-installerscript.png‎

63.8 KB
Loading

‎defender-endpoint/media/mde-linux-arm-puppet.png‎

59.3 KB
Loading

0 commit comments

Comments
 (0)