Skip to content

Commit 841c902

Browse files
denisebmsftdenisebmsft
committed
Update linux-install-with-saltack.md
1 parent cba3d47 commit 841c902

File tree

1 file changed

+160
-160
lines changed

1 file changed

+160
-160
lines changed

‎defender-endpoint/linux-install-with-saltack.md‎

Lines changed: 160 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -45,26 +45,23 @@ Before you get started, see [the main Defender for Endpoint on Linux page](micro
4545

4646
In addition, for Saltstack deployment, you need to be familiar with Saltstack administration, have Saltstack installed, configure the Master and Minions, and know how to apply states. Saltstack has many ways to complete the same task. These instructions assume availability of supported Saltstack modules, such as *apt* and *unarchive* to help deploy the package. Your organization might use a different workflow. Refer to the [Saltstack documentation](https://docs.saltproject.io/) for details.
4747

48+
Here are a few important points:
49+
4850
- Saltstack is installed on at least one computer (Saltstack calls the computer as the master).
4951
- The Saltstack master accepted the managed nodes (Saltstack calls the nodes as minions) connections.
5052
- The Saltstack minions are able to resolve communication to the Saltstack master (be default the minions try to communicate with a machine named 'salt').
51-
- Rung this ping test:
52-
53-
```bash
54-
sudo salt '*' test.ping
55-
```
56-
57-
- The Saltstack master has a file server location where the Microsoft Defender for Endpoint files can be distributed from (by default Saltstack uses the /srv/salt folder as the default distribution point)
53+
- Run the following ping test: `sudo salt '*' test.ping`
54+
- The Saltstack master has a file server location where the Microsoft Defender for Endpoint files can be distributed from (by default Saltstack uses the `/srv/salt` folder as the default distribution point)
5855

5956
## Download the onboarding package
6057

61-
Download the onboarding package from Microsoft Defender portal.
62-
6358
[!INCLUDE [Defender for Endpoint repackaging warning](../includes/repackaging-warning.md)]
6459

65-
1. In Microsoft Defender portal, go to **Settings > Endpoints > Device management > Onboarding**.
60+
1. In Microsoft Defender portal, go to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
61+
6662
2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method.
67-
3. Select **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip.
63+
64+
3. Select **Download onboarding package**. Save the file as `WindowsDefenderATPOnboardingPackage.zip`.
6865

6966
:::image type="content" source="media/portal-onboarding-linux-2.png" alt-text="The Download onboarding package option" lightbox="media/portal-onboarding-linux-2.png":::
7067

@@ -90,180 +87,182 @@ Download the onboarding package from Microsoft Defender portal.
9087

9188
## Create Saltstack state files
9289

93-
Create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to deploy and onboard Defender for Endpoint. Add the Defender for Endpoint repository and key, `install_mdatp.sls`:
94-
95-
Defender for Endpoint on Linux can be deployed from one of the following channels:
96-
97-
- *insiders-fast*, denoted as `[channel]`
98-
- *insiders-slow*, denoted as `[channel]`
99-
- *prod*, denoted as `[channel]` using the version name (see [Linux Software Repository for Microsoft Products](/linux/packages))
100-
101-
Each channel corresponds to a Linux software repository.
90+
In this step, you create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to deploy and onboard Defender for Endpoint. Then, you add the Defender for Endpoint repository and key: `install_mdatp.sls`.
10291

103-
The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
104-
105-
In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
92+
> [!NOTE]
93+
> Defender for Endpoint on Linux can be deployed from one of the following channels:
94+
>
95+
> - *insiders-fast*, denoted as `[channel]`
96+
> - *insiders-slow*, denoted as `[channel]`
97+
> - *prod*, denoted as `[channel]` using the version name (see [Linux Software Repository for Microsoft Products](/linux/packages))
98+
>
99+
> Each channel corresponds to a Linux software repository.
100+
>
101+
> The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
102+
>
103+
> In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
106104
107105
> [!WARNING]
108106
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
109107
110-
Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/[distro]/`.
111-
112-
In the following commands, replace *[distro]* and *[version]* with your information.
113-
114-
> [!NOTE]
115-
> In case of Oracle Linux and Amazon Linux 2, replace *[distro]* with "rhel". For Amazon Linux 2, replace *[version]* with "7". For Oracle utilize, replace *[version]* with the version of Oracle Linux.
116-
117-
```bash
118-
cat /srv/salt/install_mdatp.sls
119-
```
120-
121-
```output
122-
add_ms_repo:
123-
pkgrepo.managed:
124-
- humanname: Microsoft Defender Repository
125-
{% if grains['os_family'] == 'Debian' %}
126-
- name: deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/[distro]/[version]/[channel] [codename] main
127-
- dist: [codename]
128-
- file: /etc/apt/sources.list.d/microsoft-[channel].list
129-
- key_url: https://packages.microsoft.com/keys/microsoft.asc
130-
- refresh: true
131-
{% elif grains['os_family'] == 'RedHat' %}
132-
- name: packages-microsoft-[channel]
133-
- file: microsoft-[channel]
134-
- baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
135-
- gpgkey: https://packages.microsoft.com/keys/microsoft.asc
136-
- gpgcheck: true
137-
{% endif %}
138-
```
139-
140-
Add the package installed state to `install_mdatp.sls` after the `add_ms_repo` state as previously defined.
141-
142-
```Output
143-
install_mdatp_package:
144-
pkg.installed:
145-
- name: matp
146-
- required: add_ms_repo
147-
```
148-
149-
Add the onboarding file deployment to `install_mdatp.sls` after the `install_mdatp_package` as previously defined.
150-
151-
```Output
152-
copy_mde_onboarding_file:
153-
file.managed:
154-
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
155-
- source: salt://mde/mdatp_onboard.json
156-
- required: install_mdatp_package
157-
```
158-
159-
The completed install state file should look similar to this output:
160-
161-
```Output
162-
add_ms_repo:
163-
pkgrepo.managed:
164-
- humanname: Microsoft Defender Repository
165-
{% if grains['os_family'] == 'Debian' %}
166-
- name: deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/[distro]/[version]/prod [codename] main
167-
- dist: [codename]
168-
- file: /etc/apt/sources.list.d/microsoft-[channel].list
169-
- key_url: https://packages.microsoft.com/keys/microsoft.asc
170-
- refresh: true
171-
{% elif grains['os_family'] == 'RedHat' %}
172-
- name: packages-microsoft-[channel]
173-
- file: microsoft-[channel]
174-
- baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
175-
- gpgkey: https://packages.microsoft.com/keys/microsoft.asc
176-
- gpgcheck: true
177-
{% endif %}
178-
179-
install_mdatp_package:
180-
pkg.installed:
181-
- name: mdatp
182-
- required: add_ms_repo
183-
184-
copy_mde_onboarding_file:
185-
file.managed:
186-
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
187-
- source: salt://mde/mdatp_onboard.json
188-
- required: install_mdatp_package
189-
```
190-
191-
Create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to offboard and remove Defender for Endpoint. Before using the offboarding state file, you need to download the offboarding package from the Security portal and extract it in the same way you did the onboarding package. The downloaded offboarding package is only valid for a limited period of time.
192-
193-
Create an Uninstall state file `uninstall_mdapt.sls` and add the state to remove the `mdatp_onboard.json` file.
194-
195-
```bash
196-
cat /srv/salt/uninstall_mdatp.sls
197-
```
198-
199-
```Output
200-
remove_mde_onboarding_file:
201-
file.absent:
202-
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
203-
```
204-
205-
- Add the offboarding file deployment to the `uninstall_mdatp.sls` file after the `remove_mde_onboarding_file` state defined in the previous section.
206-
207-
```Output
108+
1. Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/[distro]/`.
109+
110+
In the following commands, replace *[distro]* and *[version]* with your information.
111+
112+
> [!NOTE]
113+
> In case of Oracle Linux and Amazon Linux 2, replace *[distro]* with "rhel". For Amazon Linux 2, replace *[version]* with "7". For Oracle utilize, replace *[version]* with the version of Oracle Linux.
114+
115+
```bash
116+
cat /srv/salt/install_mdatp.sls
117+
```
118+
119+
```output
120+
add_ms_repo:
121+
pkgrepo.managed:
122+
- humanname: Microsoft Defender Repository
123+
{% if grains['os_family'] == 'Debian' %}
124+
- name: deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/[distro]/[version]/[channel] [codename] main
125+
- dist: [codename]
126+
- file: /etc/apt/sources.list.d/microsoft-[channel].list
127+
- key_url: https://packages.microsoft.com/keys/microsoft.asc
128+
- refresh: true
129+
{% elif grains['os_family'] == 'RedHat' %}
130+
- name: packages-microsoft-[channel]
131+
- file: microsoft-[channel]
132+
- baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
133+
- gpgkey: https://packages.microsoft.com/keys/microsoft.asc
134+
- gpgcheck: true
135+
{% endif %}
136+
```
137+
138+
2. Add the package installed state to `install_mdatp.sls` after the `add_ms_repo` state as previously defined.
139+
140+
```Output
141+
install_mdatp_package:
142+
pkg.installed:
143+
- name: matp
144+
- required: add_ms_repo
145+
```
146+
147+
4. Add the onboarding file deployment to `install_mdatp.sls` after the `install_mdatp_package` as previously defined.
148+
149+
```Output
150+
copy_mde_onboarding_file:
151+
file.managed:
152+
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
153+
- source: salt://mde/mdatp_onboard.json
154+
- required: install_mdatp_package
155+
```
156+
157+
The completed install state file should look similar to this output:
158+
159+
```Output
160+
add_ms_repo:
161+
pkgrepo.managed:
162+
- humanname: Microsoft Defender Repository
163+
{% if grains['os_family'] == 'Debian' %}
164+
- name: deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/[distro]/[version]/prod [codename] main
165+
- dist: [codename]
166+
- file: /etc/apt/sources.list.d/microsoft-[channel].list
167+
- key_url: https://packages.microsoft.com/keys/microsoft.asc
168+
- refresh: true
169+
{% elif grains['os_family'] == 'RedHat' %}
170+
- name: packages-microsoft-[channel]
171+
- file: microsoft-[channel]
172+
- baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
173+
- gpgkey: https://packages.microsoft.com/keys/microsoft.asc
174+
- gpgcheck: true
175+
{% endif %}
176+
177+
install_mdatp_package:
178+
pkg.installed:
179+
- name: mdatp
180+
- required: add_ms_repo
181+
182+
copy_mde_onboarding_file:
183+
file.managed:
184+
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
185+
- source: salt://mde/mdatp_onboard.json
186+
- required: install_mdatp_package
187+
```
188+
189+
5. Create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to offboard and remove Defender for Endpoint. Before using the offboarding state file, you need to download the offboarding package from the Security portal and extract it in the same way you did the onboarding package. The downloaded offboarding package is only valid for a limited period of time.
190+
191+
6. Create an Uninstall state file `uninstall_mdapt.sls` and add the state to remove the `mdatp_onboard.json` file.
192+
193+
```bash
194+
cat /srv/salt/uninstall_mdatp.sls
195+
```
196+
197+
```Output
198+
remove_mde_onboarding_file:
199+
file.absent:
200+
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
201+
```
202+
203+
6. Add the offboarding file deployment to the `uninstall_mdatp.sls` file after the `remove_mde_onboarding_file` state defined in the previous section.
204+
205+
```Output
208206
offboard_mde:
209-
file.managed:
210-
- name: /etc/opt/microsoft/mdatp/mdatp_offboard.json
211-
- source: salt://mde/mdatp_offboard.json
212-
```
207+
file.managed:
208+
- name: /etc/opt/microsoft/mdatp/mdatp_offboard.json
209+
- source: salt://mde/mdatp_offboard.json
210+
```
213211
214-
- Add the removal of the MDATP package to the `uninstall_mdatp.sls` file after the `offboard_mde` state defined in the previous section.
212+
7. Add the removal of the MDATP package to the `uninstall_mdatp.sls` file after the `offboard_mde` state defined in the previous section.
215213
216-
```Output
217-
remove_mde_packages:
218-
pkg.removed:
219-
- name: mdatp
220-
```
214+
```Output
215+
remove_mde_packages:
216+
pkg.removed:
217+
- name: mdatp
218+
```
221219
222-
The complete uninstall state file should look similar to the following output:
220+
The complete uninstall state file should look similar to the following output:
223221
224-
```Output
225-
remove_mde_onboarding_file:
226-
file.absent:
227-
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
222+
```Output
223+
remove_mde_onboarding_file:
224+
file.absent:
225+
- name: /etc/opt/microsoft/mdatp/mdatp_onboard.json
228226
229-
offboard_mde:
230-
file.managed:
231-
- name: /etc/opt/microsoft/mdatp/mdatp_offboard.json
232-
- source: salt://mde/offboard/mdatp_offboard.json
227+
offboard_mde:
228+
file.managed:
229+
- name: /etc/opt/microsoft/mdatp/mdatp_offboard.json
230+
- source: salt://mde/offboard/mdatp_offboard.json
233231
234-
remove_mde_packages:
232+
remove_mde_packages:
235233
pkg.removed:
236234
- name: mdatp
237-
```
235+
```
238236
239237
## Deployment
240238
241-
Now apply the state to the minions. The below command applies the state to machines with the name that begins with `mdetest`.
239+
In this step, you apply the state to the minions. The following command applies the state to machines with the name that begins with `mdetest`.
242240
243-
- Installation:
244241
245-
```bash
246-
salt 'mdetest*' state.apply install_mdatp
247-
```
242+
1. Installation:
248243
249-
> [!IMPORTANT]
250-
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes.
244+
```bash
245+
salt 'mdetest*' state.apply install_mdatp
246+
```
251247
252-
- Validation/configuration:
248+
> [!IMPORTANT]
249+
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes.
253250
254-
```bash
255-
salt 'mdetest*' cmd.run 'mdatp connectivity test'
256-
```
251+
2. Validation/configuration:
257252
258-
```bash
259-
salt 'mdetest*' cmd.run 'mdatp health'
260-
```
253+
```bash
254+
salt 'mdetest*' cmd.run 'mdatp connectivity test'
255+
```
261256
262-
- Uninstallation:
257+
```bash
258+
salt 'mdetest*' cmd.run 'mdatp health'
259+
```
263260
264-
```bash
265-
salt 'mdetest*' state.apply uninstall_mdatp
266-
```
261+
3. Uninstallation:
262+
263+
```bash
264+
salt 'mdetest*' state.apply uninstall_mdatp
265+
```
267266
268267
## Log installation issues
269268
@@ -280,4 +279,5 @@ When upgrading your operating system to a new major version, you must first unin
280279
## See also
281280

282281
- [Investigate agent health issues](health-status.md)
282+
283283
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)