Skip to content

Commit d390933

Browse files
AruneemaXDAruneemaXD
authored
Update linux-preferences.md
1 parent 1d4b6c4 commit d390933

File tree

1 file changed

+60
-64
lines changed

1 file changed

+60
-64
lines changed

‎defender-endpoint/linux-preferences.md‎

Lines changed: 60 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,9 @@ Specifies the degree of parallelism for on-demand scans. This corresponds to the
136136
137137
#### Exclusion merge policy
138138

139+
> [!NOTE]
140+
> ExclusionSetting - you can use
141+
139142
Specifies the merge policy for exclusions. It can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). Administrator-defined (admin_only) are exclusions that are configured by Defender for Endpoint policy. This setting can be used to restrict local users from defining their own exclusions.
140143

141144
|Description|JSON Value|Defender Portal Value|
@@ -382,9 +385,9 @@ Specify the maximum number of entries to keep in the scan history. Entries inclu
382385
> [!NOTE]
383386
> Available in Defender for Endpoint version `101.23092.0012` or later.
384387
385-
The *exclusionSettings* section of the configuration profile is used to configure various exclusion for Microsoft defender for endpoint.
388+
The *exclusionSettings* section of the configuration profile is used to configure various exclusions for Microsoft Defender for Endpoint for Linux.
386389

387-
|Description|Value|
390+
|Description|JSON Value|
388391
|---|---|
389392
|**Key**|exclusionSettings|
390393
|**Data type**|Dictionary (nested preference)|
@@ -397,7 +400,7 @@ The *exclusionSettings* section of the configuration profile is used to configur
397400

398401
Specifies the merge policy for exclusions. It specifies if it can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). This setting can be used to restrict local users from defining their own exclusions. It is applicable for exclusions of all scopes.
399402

400-
|Description|Value|
403+
|Description|JSON Value|
401404
|---|---|
402405
|**Key**|mergePolicy|
403406
|**Data type**|String|
@@ -408,7 +411,7 @@ Specifies the merge policy for exclusions. It specifies if it can be a combinati
408411

409412
Entities that need to be excluded can be specified by full paths, extensions, or file names. Each exclusion entity, i.e., either full path, extension or file name has an optional scope that can be specified. If not specified, the default value of scope in this section is *global*. (Exclusions are specified as an array of items, administrator can specify as many elements as necessary, in any order.)
410413

411-
|Description|Value|
414+
|Description|JSON Value|
412415
|---|---|
413416
|**Key**|exclusions|
414417
|**Data type**|Dictionary (nested preference)|
@@ -418,7 +421,7 @@ Entities that need to be excluded can be specified by full paths, extensions, or
418421

419422
Specifies the type of content excluded from the scan.
420423

421-
|Description|Value|
424+
|Description|JSON Value|
422425
|---|---|
423426
|**Key**|$type|
424427
|**Data type**|String|
@@ -433,104 +436,57 @@ If nothing is specified in for an exclusion under *exclusionSettings* in managed
433436
> [!NOTE]
434437
> Previously configured antivirus exclusions under (`antivirusEngine`) in managed JSON will continue to function and their scope is considered (`epp`) since they were added as antivirus exclusions.
435438
436-
|Description|Value|
439+
|Description|JSON Value|
437440
|---|---|
438441
|**Key**|scopes|
439442
|**Data type**|Set of strings|
440443
|**Possible values**|epp <p> global|
441444

442-
>[!NOTE]
443-
>Previously applied exclusions using (`mdatp_managed.json`) or by CLI will remain unaffected. The scope for those exclusions will be (`epp`) since they were added under (`antivirusEngine`).
445+
> [!NOTE]
446+
> Previously applied exclusions using (`mdatp_managed.json`) or by CLI will remain unaffected. The scope for those exclusions will be (`epp`) since they were added under (`antivirusEngine`).
444447
##### Path to excluded content
445448

446449
Used to exclude content from the scan by full file path.
447450

448-
|Description|Value|
451+
|Description|JSON Value|
449452
|---|---|
450453
|**Key**|path|
451454
|**Data type**|String|
452455
|**Possible values**|valid paths|
453-
|**Comments**|Applicable only if *$type* is *excludedPath*. Wildcard not supported if exclusion has *global* as a scope.|
456+
|**Comments**|Applicable only if *$type* is *excludedPath*.<br> *Wildcard not supported if exclusion has global as a scope.*|
454457

455458
##### Path type (file / directory)
456459

457460
Indicates if the *path* property refers to a file or directory.
458461

459-
|Description|Value|
462+
|Description|JSON Value|
460463
|---|---|
461464
|**Key**|isDirectory|
462465
|**Data type**|Boolean|
463466
|**Possible values**|false (default) <p> true|
464-
|**Comments**|Applicable only if *$type* is *excludedPath* Wildcard not supported if exclusion has *global* as a scope.|
467+
|**Comments**|Applicable only if *$type* is *excludedPath*.<br> *Wildcard not supported if exclusion has global as a scope.*|
465468

466469
##### File extension excluded from the scan
467470

468471
Used to exclude content from the scan by file extension.
469472

470-
|Description|Value|
473+
|Description|JSON Value|
471474
|---|---|
472475
|**Key**|extension|
473476
|**Data type**|String|
474477
|**Possible values**|valid file extensions|
475-
|**Comments**|Applicable only if *$type* is *excludedFileExtension*. Not supported if exclusion has *global* as a scope.|
478+
|**Comments**|Applicable only if *$type* is *excludedFileExtension*.<br> *Not supported if exclusion has global as a scope.*|
476479

477480
##### Process excluded from the scan*
478481

479482
Specifies a process for which all file activity is excluded from scanning. The process can be specified either by its name (for example, `cat`) or full path (for example, `/bin/cat`).
480483

481-
|Description|Value|
484+
|Description|JSON Value|
482485
|---|---|
483486
|**Key**|name|
484487
|**Data type**|String|
485488
|**Possible values**|any string|
486-
|**Comments**|Applicable only if *$type* is *excludedFileName*. Wildcard and process name not supported if exclusion has *global* as a scope, need to provide full path.|
487-
488-
#### Sample profile
489-
490-
```JSON
491-
{
492-
"exclusionSettings":{
493-
"exclusions":[
494-
{
495-
"$type":"excludedPath",
496-
"isDirectory":true,
497-
"path":"/home/*/git<EXAMPLE DO NOT USE>",
498-
"scopes": [
499-
"epp"
500-
]
501-
},
502-
{
503-
"$type":"excludedPath",
504-
"isDirectory":true,
505-
"path":"/run<EXAMPLE DO NOT USE>",
506-
"scopes": [
507-
"global"
508-
]
509-
},
510-
{
511-
"$type":"excludedPath",
512-
"isDirectory":false,
513-
"path":"/var/log/system.log<EXAMPLE DO NOT USE><EXCLUDED IN ALL SCENARIOS>",
514-
"scopes": [
515-
"epp", "global"
516-
]
517-
},
518-
{
519-
"$type":"excludedFileExtension",
520-
"extension":".pdf<EXAMPLE DO NOT USE>",
521-
"scopes": [
522-
"epp"
523-
]
524-
},
525-
{
526-
"$type":"excludedFileName",
527-
"name":"/bin/cat<EXAMPLE DO NOT USE><NO SCOPE PROVIDED - GLOBAL CONSIDERED>"
528-
}
529-
],
530-
"mergePolicy":"admin_only"
531-
}
532-
}
533-
```
489+
|**Comments**|Applicable only if *$type* is *excludedFileName*. <br> *Wildcard and process name not supported if exclusion has global as a scope, need to provide full path.*|
534490

535491
#### Advanced scan options
536492

@@ -961,7 +917,47 @@ The following configuration profile contains entries for all settings described
961917
"automaticSampleSubmissionConsent":"safe",
962918
"automaticDefinitionUpdateEnabled":true,
963919
"proxy": "<EXAMPLE DO NOT USE> http://proxy.server:port/"
964-
}
920+
},
921+
"exclusionSettings":{
922+
"exclusions":[
923+
{
924+
"$type":"excludedPath",
925+
"isDirectory":true,
926+
"path":"/home/*/git<EXAMPLE DO NOT USE>",
927+
"scopes": [
928+
"epp"
929+
]
930+
},
931+
{
932+
"$type":"excludedPath",
933+
"isDirectory":true,
934+
"path":"/run<EXAMPLE DO NOT USE>",
935+
"scopes": [
936+
"global"
937+
]
938+
},
939+
{
940+
"$type":"excludedPath",
941+
"isDirectory":false,
942+
"path":"/var/log/system.log<EXAMPLE DO NOT USE><EXCLUDED IN ALL SCENARIOS>",
943+
"scopes": [
944+
"epp", "global"
945+
]
946+
},
947+
{
948+
"$type":"excludedFileExtension",
949+
"extension":".pdf<EXAMPLE DO NOT USE>",
950+
"scopes": [
951+
"epp"
952+
]
953+
},
954+
{
955+
"$type":"excludedFileName",
956+
"name":"/bin/cat<EXAMPLE DO NOT USE><NO SCOPE PROVIDED - GLOBAL CONSIDERED>"
957+
}
958+
],
959+
"mergePolicy":"admin_only"
960+
}
965961
}
966962
```
967963

0 commit comments

Comments
 (0)