You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Servers](/azure/defender-for-cloud/integration-defender-for-endpoint)
29
27
30
28
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-investigateip-abovefoldlink)
31
29
32
-
This article describes how to deploy Defender for Endpoint on Linux using Saltstack. A successful deployment requires the completion of all of the following tasks:
33
30
34
-
-[Download the onboarding package](#download-the-onboarding-package)
35
-
-[Create Saltstack state files](#create-saltstack-state-files)
36
-
-[Deployment](#deployment)
37
-
-[Reference](#reference)
31
+
This article describes how to deploy Defender for Endpoint on Linux using Saltstack. A successful deployment requires the completion of all of the steps in this article.
38
32
39
33
[!INCLUDE [Microsoft Defender for Endpoint third-party tool support](../includes/support.md)]
40
34
41
35
## Prerequisites and system requirements
42
36
43
37
Before you get started, see [the main Defender for Endpoint on Linux page](microsoft-defender-endpoint-linux.md) for a description of prerequisites and system requirements for the current software version.
44
38
45
-
In addition, for Saltstack deployment, you need to be familiar with Saltstack administration, have Saltstack installed, configure the Master and Minions, and know how to apply states. Saltstack has many ways to complete the same task. These instructions assume availability of supported Saltstack modules, such as *apt* and *unarchive* to help deploy the package. Your organization might use a different workflow. Refer to the [Saltstack documentation](https://docs.saltproject.io/) for details.
39
+
In addition, for Saltstack deployment, you need to be familiar with Saltstack administration, have Saltstack installed, configure the Master and Minions, and know how to apply states. Saltstack has many ways to complete the same task. These instructions assume availability of supported Saltstack modules, such as *apt* and *unarchive* to help deploy the package. Your organization might use a different workflow. For more information, see [Saltstack documentation](https://docs.saltproject.io/).
46
40
47
41
Here are a few important points:
48
42
@@ -66,38 +60,58 @@ Here are a few important points:
66
60
67
61
4. On the SaltStack Master, extract the contents of the archive to the SaltStack Server's folder (typically `/srv/salt`):
There are two ways you can create the Saltstack state files:
86
75
87
-
## Create Saltstack state files
76
+
-**Use the installer Script (recommended):** With this method, the script automates deployment by installing the agent, onboarding the device to the [Microsoft Defender portal](https://security.microsoft.com), and configuring the repositories to pick the correct agent compatible with your Linux distribution.
77
+
78
+
-**Manually configure the repositories:** With this method, repositories must be configured manually along with selecting agent version compatible with your Linux distribution. This method gives you more granular control over the deployment process.
79
+
80
+
### Create Saltstack state files using the installer script
81
+
82
+
1. Pull the [installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh) from Microsoft GitHub Repository, or use the following command to download it:
2. Create the state file `/srv/salt/install_mdatp.sls` with the following content. The same can be downloaded from [GitHub](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/salt.install_mdatp_simplified.sls)
90
+
91
+
```bash
92
+
#Download the mde_installer.sh: https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh
> The installer script also supports other parameters such as channel (insiders-fast, insiders-slow, prod (default) ), realtime protection, version, etc. To select from the list of available options, check help through the following command:
102
+
>```./mde_installer.sh --help```
103
+
104
+
### Create Saltstack state files by manually configuring repositories
88
105
89
106
In this step, you create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to deploy and onboard Defender for Endpoint. Then, you add the Defender for Endpoint repository and key: `install_mdatp.sls`.
90
107
91
108
> [!NOTE]
92
109
> Defender for Endpoint on Linux can be deployed from one of the following channels:
93
-
>
94
110
> -*insiders-fast*, denoted as `[channel]`
95
111
> -*insiders-slow*, denoted as `[channel]`
96
112
> -*prod*, denoted as `[channel]` using the version name (see [Linux Software Repository for Microsoft Products](/linux/packages))
97
113
>
98
-
> Each channel corresponds to a Linux software repository.
99
-
>
100
-
> The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in*insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
114
+
> Each channel corresponds to a Linux software repository. The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
101
115
>
102
116
> In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
103
117
@@ -106,7 +120,7 @@ In this step, you create a SaltState state file in your configuration repository
106
120
107
121
1. Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/[distro]/`.
108
122
109
-
In the following commands, replace *[distro]* and *[version]* with your information.
123
+
2. In the following commands, replace *[distro]* and *[version]* with your information.
110
124
111
125
> [!NOTE]
112
126
> In case of Oracle Linux and Amazon Linux 2, replace *[distro]* with "rhel". For Amazon Linux 2, replace *[version]* with "7". For Oracle utilize, replace *[version]* with the version of Oracle Linux.
@@ -134,7 +148,7 @@ In this step, you create a SaltState state file in your configuration repository
134
148
{% endif %}
135
149
```
136
150
137
-
2. Add the package installed state to `install_mdatp.sls` after the `add_ms_repo` state as previously defined.
151
+
3. Add the package installed state to `install_mdatp.sls` after the `add_ms_repo` state as previously defined.
138
152
139
153
```console
140
154
install_mdatp_package:
@@ -185,7 +199,7 @@ In this step, you create a SaltState state file in your configuration repository
185
199
- required: install_mdatp_package
186
200
```
187
201
188
-
5. Create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to offboard and remove Defender for Endpoint. Before using the offboarding state file, you need to download the offboarding package from the Security portal and extract it in the same way you did the onboarding package. The downloaded offboarding package is only valid for a limited period of time.
202
+
5. Create a SaltState state file in your configuration repository (typically `/srv/salt`) that applies the necessary states to offboard and remove Defender for Endpoint. Before using the offboarding state file, you need to download the offboarding package from the [Microsoft Defender portal](https://security.microsoft.com) and extract it in the same way you did the onboarding package. The downloaded offboarding package is only valid for a limited period of time.
189
203
190
204
6. Create an Uninstall state file `uninstall_mdapt.sls` and add the state to remove the `mdatp_onboard.json` file.
191
205
@@ -199,7 +213,7 @@ In this step, you create a SaltState state file in your configuration repository
6. Add the offboarding file deployment to the `uninstall_mdatp.sls` file after the `remove_mde_onboarding_file` state defined in the previous section.
216
+
7. Add the offboarding file deployment to the `uninstall_mdatp.sls` file after the `remove_mde_onboarding_file` state defined in the previous section.
203
217
204
218
```console
205
219
offboard_mde:
@@ -208,7 +222,7 @@ In this step, you create a SaltState state file in your configuration repository
208
222
- source: salt://mde/mdatp_offboard.json
209
223
```
210
224
211
-
7. Add the removal of the MDATP package to the `uninstall_mdatp.sls` file after the `offboard_mde` state defined in the previous section.
225
+
8. Add the removal of the MDATP package to the `uninstall_mdatp.sls` file after the `offboard_mde` state defined in the previous section.
212
226
213
227
```console
214
228
remove_mde_packages:
@@ -233,10 +247,9 @@ In this step, you create a SaltState state file in your configuration repository
233
247
- name: mdatp
234
248
```
235
249
236
-
## Deployment
237
-
238
-
In this step, you apply the state to the minions. The following command applies the state to machines with the name that begins with `mdetest`.
250
+
## Deploy Defender on Endpoint using the state files created earlier
239
251
252
+
This step applies to both the installer script or manual configuration method. In this step, you apply the state to the minions. The following command applies the state to machines with the name that begins with `mdetest`.
240
253
241
254
1. Installation:
242
255
@@ -263,20 +276,35 @@ In this step, you apply the state to the minions. The following command applies
263
276
salt 'mdetest*' state.apply uninstall_mdatp
264
277
```
265
278
266
-
## Log installation issues
279
+
## Troubleshoot installation issues
280
+
281
+
To troubleshoot issues:
282
+
283
+
1. For information on how to find the log that's generated automatically when an installation error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
284
+
285
+
2. For information about common installation issues, see [Installation issues](/defender-endpoint/linux-support-install).
267
286
268
-
For more information on how to find the automatically generated log that's created by the installer when an error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
287
+
3. If the health of the device is `false`, see [Defender for Endpoint agent health issues](/defender-endpoint/health-status).
288
+
289
+
4. For product performance issues, see [Troubleshoot performance issues](/defender-endpoint/linux-support-perf).
290
+
291
+
5. For proxy and connectivity issues, see [Troubleshoot cloud connectivity issues](/defender-endpoint/linux-support-connectivity).
292
+
293
+
To get support from Microsoft, open a support ticket, and provide the log files created by using the [client analyzer](/defender-endpoint/run-analyzer-macos-linux).
294
+
295
+
## How to configure policies for Microsoft Defender on Linux
296
+
297
+
You can configure antivirus or EDR settings on your endpoints using any of the following methods:
298
+
299
+
- See [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
300
+
- See [security settings management](/mem/intune/protect/mde-security-integration) to configure settings in the Microsoft Defender portal.
269
301
270
302
## Operating system upgrades
271
303
272
-
When upgrading your operating system to a new major version, you must first uninstall Defender for Endpoint on Linux, install the upgrade, and finally reconfigure Defender for Endpoint on Linux on your device.
304
+
When upgrading your operating system to a new major version, you must first uninstall Defender for Endpoint on Linux, install the upgrade, and finally reconfigure Defender for Endpoint on your Linux device.
0 commit comments