Skip to content

Commit 665de23

Browse files
authored
Merge pull request #1068 from MicrosoftDocs/deniseb-fix
https://aka.ms/MDE-Linux-EDR-DIY
2 parents 11a1faf + be610c4 commit 665de23

File tree

3 files changed

+26
-26
lines changed

3 files changed

+26
-26
lines changed

defender-endpoint/edr-detection.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,11 @@ powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionP
5454

5555
### Linux
5656

57-
1. Download [script file](https://aka.ms/LinuxDIY) to an onboarded Linux server
57+
1. Download [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server
5858

5959

6060
```bash
61-
curl -o ~/Downloads/MDE Linux DIY.zip https://aka.ms/LinuxDIY
61+
curl -o ~/Downloads/MDE Linux DIY.zip https://aka.ms/MDE-Linux-EDR-DIY
6262
```
6363

6464
1. Extract the zip

defender-endpoint/linux-install-manually.md

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
ms.topic: conceptual
1616
ms.subservice: linux
1717
search.appverid: met150
18-
ms.date: 05/01/2024
18+
ms.date: 08/01/2024
1919
---
2020

2121
# Deploy Microsoft Defender for Endpoint on Linux manually
@@ -42,7 +42,7 @@ This article describes how to deploy Microsoft Defender for Endpoint on Linux ma
4242
- [Ubuntu and Debian systems](#ubuntu-and-debian-systems-1)
4343
- [Mariner](#mariner)
4444
- [Application installation](#application-installation)
45-
- [RHEL and variants (CentOS, Fedora, Oracle Linux, Amazon Linux 2, Rocky and Alma)](#rhel-and-variants-centos-fedora-oracle-linux-amazon-linux-2-rocky-and-alma)
45+
- [RHEL and variants (CentOS, Fedora, Oracle Linux, Amazon Linux 2, Rocky, and Alma)](#rhel-and-variants-centos-fedora-oracle-linux-amazon-linux-2-rocky-and-alma)
4646
- [SLES and variants](#sles-and-variants)
4747
- [Ubuntu and Debian systems](#ubuntu-and-debian-systems)
4848
- [Mariner](#mariner-1)
@@ -58,9 +58,9 @@ Before you get started, see [Microsoft Defender for Endpoint on Linux](microsoft
5858
5959
## Configure the Linux software repository
6060

61-
Defender for Endpoint on Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insiders-fast*, *insiders-slow*, or *prod*. Each of these channels corresponds to a Linux software repository. The instructions in this article describe configuring your device to use one of these repositories.
61+
Defender for Endpoint on Linux can be deployed from one of the following channels (denoted as *[channel]*): *insiders-fast*, *insiders-slow*, or `prod`. Each of these channels corresponds to a Linux software repository. The instructions in this article describe configuring your device to use one of these repositories.
6262

63-
The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow* and lastly by *prod*.
63+
The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow* and lastly by `prod`.
6464

6565
In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
6666

@@ -91,7 +91,7 @@ Options:
9191

9292
Read more [here](https://github.com/microsoft/mdatp-xplat/tree/master/linux/installation).
9393

94-
### RHEL and variants (CentOS, Fedora, Oracle Linux, Amazon Linux 2, Rocky and Alma)
94+
### RHEL and variants (CentOS, Fedora, Oracle Linux, Amazon Linux 2, Rocky, and Alma)
9595

9696
- Install `yum-utils` if it isn't installed yet:
9797

@@ -128,7 +128,7 @@ Read more [here](https://github.com/microsoft/mdatp-xplat/tree/master/linux/inst
128128
> [!TIP]
129129
> Use hostnamectl command to identify system related information including release *[version]*.
130130
131-
For example, if you're running CentOS 7 and want to deploy Defender for Endpoint on Linux from the *prod* channel:
131+
For example, if you're running CentOS 7 and want to deploy Defender for Endpoint on Linux from the `prod` channel:
132132

133133
```bash
134134
sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/rhel/7/prod.repo
@@ -160,7 +160,7 @@ Read more [here](https://github.com/microsoft/mdatp-xplat/tree/master/linux/inst
160160
> [!TIP]
161161
> Use SPident command to identify system related information including release *[version]*.
162162
163-
For example, if you're running SLES 12 and wish to deploy Microsoft Defender for Endpoint on Linux from the *prod* channel:
163+
For example, if you're running SLES 12 and wish to deploy Microsoft Defender for Endpoint on Linux from the `prod` channel:
164164

165165
```bash
166166
sudo zypper addrepo -c -f -n microsoft-prod https://packages.microsoft.com/config/sles/12/prod.repo
@@ -198,7 +198,7 @@ Read more [here](https://github.com/microsoft/mdatp-xplat/tree/master/linux/inst
198198
> [!TIP]
199199
> Use hostnamectl command to identify system related information including release *[version]*.
200200
201-
For example, if you're running Ubuntu 18.04 and wish to deploy Microsoft Defender for Endpoint on Linux from the *prod* channel:
201+
For example, if you're running Ubuntu 18.04 and wish to deploy Microsoft Defender for Endpoint on Linux from the `prod` channel:
202202

203203
```bash
204204
curl -o microsoft.list https://packages.microsoft.com/config/ubuntu/18.04/prod.list
@@ -210,7 +210,7 @@ Read more [here](https://github.com/microsoft/mdatp-xplat/tree/master/linux/inst
210210
sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-[channel].list
211211
```
212212

213-
For example, if you chose *prod* channel:
213+
For example, if you chose `prod` channel:
214214

215215
```bash
216216
sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-prod.list
@@ -263,7 +263,7 @@ curl -sSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | su
263263
> [!NOTE]
264264
> On Mariner, Insider Fast Channel is not available.
265265
266-
If you want to deploy Defender for Endpoint on Linux from the *prod* channel. Use the following commands
266+
If you want to deploy Defender for Endpoint on Linux from the `prod` channel. Use the following commands
267267

268268
```bash
269269
sudo dnf install mariner-repos-extras
@@ -476,7 +476,7 @@ Download the onboarding package from Microsoft Defender portal.
476476
curl -o /tmp/eicar.com.txt https://secure.eicar.org/eicar.com.txt
477477
```
478478
479-
- You can run additional detection tests on zip files using either of the following commands:
479+
- You can run more detection tests on zip files using either of the following commands:
480480
481481
```bash
482482
curl -o /tmp/eicar_com.zip https://secure.eicar.org/eicar_com.zip
@@ -493,7 +493,7 @@ Download the onboarding package from Microsoft Defender portal.
493493
494494
- Verify that the onboarded Linux server appears in Microsoft Defender XDR. If this is the first onboarding of the machine, it can take up to 20 minutes until it appears.
495495
496-
- Download and extract the [script file](https://aka.ms/LinuxDIY) to an onboarded Linux server and run the following command: `./mde_linux_edr_diy.sh`
496+
- Download and extract the [script file](https://aka.ms/MDE-Linux-EDR-DIY) to an onboarded Linux server and run the following command: `./mde_linux_edr_diy.sh`
497497
498498
- After a few minutes, a detection should be raised in Microsoft Defender XDR.
499499
@@ -503,16 +503,16 @@ Download the onboarding package from Microsoft Defender portal.
503503
504504
The following external package dependencies exist for the mdatp package:
505505
506-
- The mdatp RPM package requires "glibc >= 2.17", "audit", "policycoreutils", "semanage" "selinux-policy-targeted", "mde-netfilter"
507-
- For RHEL6 the mdatp RPM package requires "audit", "policycoreutils", "libselinux", "mde-netfilter"
508-
- For DEBIAN the mdatp package requires "libc6 >= 2.23", "uuid-runtime", "auditd", "mde-netfilter"
509-
- For Mariner the mdatp package requires "attr", "audit", "diffutils", "libacl", "libattr", "libselinux-utils", "selinux-policy", "policycoreutils", "mde-netfilter"
506+
- The mdatp RPM package requires `glibc >= 2.17`, `audit`, `policycoreutils`, `semanage` `selinux-policy-targeted`, `mde-netfilter`
507+
- For RHEL6 the mdatp RPM package requires `audit`, `policycoreutils`, `libselinux`, `mde-netfilter`
508+
- For DEBIAN the mdatp package requires `libc6 >= 2.23`, `uuid-runtime`, `auditd`, `mde-netfilter`
509+
- For Mariner the mdatp package requires `attr`, `audit`, `diffutils`, `libacl`, `libattr`, `libselinux-utils`, `selinux-policy`, `policycoreutils`, `mde-netfilter`
510510
511511
The mde-netfilter package also has the following package dependencies:
512512
513-
- For DEBIAN, the mde-netfilter package requires "libnetfilter-queue1", "libglib2.0-0"
514-
- For RPM, the mde-netfilter package requires "libmnl", "libnfnetlink", "libnetfilter_queue", "glib2"
515-
- For Mariner, the mde-netfilter package requires "libnfnetlink", "libnetfilter_queue"
513+
- For DEBIAN, the mde-netfilter package requires `libnetfilter-queue1`, `libglib2.0-0`
514+
- For RPM, the mde-netfilter package requires `libmnl`, `libnfnetlink`, `libnetfilter_queue`, `glib2`
515+
- For Mariner, the mde-netfilter package requires `libnfnetlink`, `libnetfilter_queue`
516516
517517
If the Microsoft Defender for Endpoint installation fails due to missing dependencies errors, you can manually download the prerequisite dependencies.
518518
@@ -523,7 +523,7 @@ See [Log installation issues](linux-resources.md#log-installation-issues) for mo
523523
524524
## How to migrate from Insiders-Fast to Production channel
525525
526-
1. Uninstall the "Insiders-Fast channel" version of Defender for Endpoint on Linux.
526+
1. Uninstall the `Insiders-Fast channel` version of Defender for Endpoint on Linux.
527527
528528
```bash
529529
sudo yum remove mdatp
@@ -536,13 +536,13 @@ See [Log installation issues](linux-resources.md#log-installation-issues) for mo
536536
```
537537
538538
> [!NOTE]
539-
> The output should show "packages-microsoft-com-fast-prod".
539+
> The output should show `packages-microsoft-com-fast-prod`.
540540
541541
```bash
542542
sudo yum-config-manager --disable packages-microsoft-com-fast-prod
543543
```
544544
545-
1. Redeploy Microsoft Defender for Endpoint on Linux using the "Production channel".
545+
1. Redeploy Microsoft Defender for Endpoint on Linux using the Production channel.
546546
547547
## Uninstallation
548548

defender-endpoint/mde-plugin-wsl.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
ms.custom:
1616
- partner-contribution
1717
audience: ITPro
18-
ms.date: 07/26/2024
18+
ms.date: 08/01/2024
1919
search.appverid: MET150
2020
---
2121

@@ -192,7 +192,7 @@ To test the plug-in after installation, follow these steps:
192192

193193
2. Run the command `wsl`.
194194

195-
3. Download and extract the script file from [https://aka.ms/LinuxDIY](https://aka.ms/LinuxDIY).
195+
3. Download and extract the script file from [https://aka.ms/MDE-Linux-EDR-DIY](https://aka.ms/MDE-Linux-EDR-DIY).
196196

197197
4. At the Linux prompt, run the command `./mde_linux_edr_diy.sh`.
198198

0 commit comments

Comments
 (0)