You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/microsoft-defender-endpoint-linux.md
+23-23Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: linux
17
17
search.appverid: met150
18
-
ms.date: 01/07/2025
18
+
ms.date: 01/10/2025
19
19
---
20
20
21
21
# Microsoft Defender for Endpoint on Linux
@@ -45,7 +45,7 @@ Microsoft Defender for Endpoint for Linux includes anti-malware and endpoint det
45
45
46
46
> [!NOTE]
47
47
> Linux distribution using system manager supports both SystemV and Upstart.
48
-
> Microsoft Defender for Endpoint on Linux agent is independent from [OMS agent](/azure/azure-monitor/agents/agents-overview#log-analytics-agent).
48
+
> Microsoft Defender for Endpoint on Linux agent is independent from [Operation Management Suite (OMS) agent](/azure/azure-monitor/agents/agents-overview#log-analytics-agent).
49
49
> Microsoft Defender for Endpoint relies on its own independent telemetry pipeline.
50
50
51
51
### System requirements
@@ -106,30 +106,30 @@ Microsoft Defender for Endpoint for Linux includes anti-malware and endpoint det
106
106
107
107
- List of supported filesystems for RTP, Quick, Full, and Custom Scan.
108
108
109
-
|RTP, Quick, Full Scan| Custom Scan|
110
-
|---|---|
111
-
|`btrfs`|All filesystems supported for RTP, Quick, Full Scan|
112
-
|`ecryptfs`|`Efs`|
113
-
|`ext2`|`S3fs`|
114
-
|`ext3`|`Blobfuse`|
115
-
|`ext4`|`Lustr`|
116
-
|`fuse`|`glustrefs`|
117
-
|`fuseblk`|`Afs`|
118
-
|`jfs`|`sshfs`|
119
-
|`nfs` (v3 only)|`cifs`|
120
-
|`overlay`|`smb`|
121
-
|`ramfs`|`gcsfuse`|
122
-
|`reiserfs`|`sysfs`|
123
-
|`tmpfs`||
124
-
|`udf`||
125
-
|`vfat`||
126
-
|`xfs`||
127
-
109
+
|RTP, Quick, Full Scan| Custom Scan|
110
+
|---|---|
111
+
|`btrfs`|All filesystems supported for RTP, Quick, Full Scan|
112
+
|`ecryptfs`|`Efs`|
113
+
|`ext2`|`S3fs`|
114
+
|`ext3`|`Blobfuse`|
115
+
|`ext4`|`Lustr`|
116
+
|`fuse`|`glustrefs`|
117
+
|`fuseblk`|`Afs`|
118
+
|`jfs`|`sshfs`|
119
+
|`nfs` (v3 only)|`cifs`|
120
+
|`overlay`|`smb`|
121
+
|`ramfs`|`gcsfuse`|
122
+
|`reiserfs`|`sysfs`|
123
+
|`tmpfs`||
124
+
|`udf`||
125
+
|`vfat`||
126
+
|`xfs`||
127
+
128
128
> [!NOTE]
129
-
> Starting with version `101.24082.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology.
129
+
> Starting with version `101.24082.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient extended Berkeley Packet Filter (eBPF) technology.
130
130
> If eBPF isn't supported on your machines, or if there are specific requirements to remain on Auditd, and your machines are using Defender for Endpoint on Linux version `101.24072.0001` or lower, then Audit framework (`auditd`) must be enabled on your system.
131
131
> If you're using Auditd, then system events captured by rules added to `/etc/audit/rules.d/` adds to `audit.log`(s) and might affect host auditing and upstream collection. Events added by Microsoft Defender for Endpoint on Linux are tagged with the `mdatp` key.
132
-
132
+
133
133
- /opt/microsoft/mdatp/sbin/wdavdaemon requires executable permission. For more information, see "Ensure that the daemon has executable permission" in [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](linux-support-install.md).
0 commit comments