Merge pull request #1469 from MicrosoftDocs/deniseb-mde-linux

update mde linux

Author: padmagit77

defender-endpoint/mde-linux-deployment-on-sap.md

@@ -2,9 +2,9 @@
 title: Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP 
 description: Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP 
 ms.service: defender-endpoint
-ms.author: cgardin
-author: cgardin
-ms.reviewer: shlomiakirav  
+ms.author: deniseb
+author: denisebmsft
+ms.reviewer: cgardin  
 ms.localizationpriority: medium
 manager: deniseb
 audience: ITPro
@@ -15,7 +15,7 @@ ms.collection:
 ms.topic: conceptual
 ms.subservice: linux
 search.appverid: met150
-ms.date: 05/17/2024
+ms.date: 09/26/2024
 ms.custom: 
 - partner-contribution
 ---
@@ -28,7 +28,7 @@ ms.custom:
 
 This article provides deployment guidance for Microsoft Defender for Endpoint on Linux for SAP. This article includes recommended SAP OSS (Online Services System) notes, the system requirements, prerequisites, important configuration settings, recommended antivirus exclusions, and guidance on scheduling antivirus scans.
 
-Conventional security defenses that have been commonly used to protect SAP systems such as isolating infrastructure behind firewalls and limiting interactive operating system logons are no longer considered sufficient to mitigate modern sophisticated threats. It's essential to deploy modern defenses to detect and contain threats in real-time. SAP applications unlike most other workloads require basic assessment and validation before deploying Microsoft Defender for Endpoint. The enterprise security administrators should contact the SAP Basis team prior to deploying Defender for Endpoint. The SAP Basis Team should be cross trained with a basic level of knowledge about Defender for Endpoint.
+Conventional security defenses that have been commonly used to protect SAP systems, such as isolating infrastructure behind firewalls and limiting interactive operating system logons, are no longer considered sufficient to mitigate modern sophisticated threats. It's essential to deploy modern defenses to detect and contain threats in real-time. SAP applications unlike most other workloads require basic assessment and validation before deploying Microsoft Defender for Endpoint. The enterprise security administrators should contact the SAP Basis team prior to deploying Defender for Endpoint. The SAP Basis Team should be cross trained with a basic level of knowledge about Defender for Endpoint.
 
 ## Recommended SAP OSS Notes
 
@@ -48,7 +48,7 @@ Conventional security defenses that have been commonly used to protect SAP syste
 - SAP only supports certain Linux File systems. In general, XFS and EXT3 are used. Oracle Automatic Storage Management (ASM) filesystem is sometimes used for Oracle DBMS and can't be read by Defender for Endpoint.
 - Some SAP applications use "standalone engines" such as TREX, Adobe Document Server, Content Server and LiveCache. These engines require specific configuration and file exclusions.
 - SAP applications often have Transport and Interface directories with many thousands of small files. If the number of files is larger than 100,000, it might and affect performance. It's recommended to archive files.
-- It's strongly recommended to deploy Defender for Endpoint to nonproductive SAP landscapes for several weeks before deploying to production. The SAP Basis Team should use tools such as sysstat, KSAR, and nmon to verify if CPU and other performance parameters are impacted. 
+- It's strongly recommended to deploy Defender for Endpoint to nonproductive SAP landscapes for several weeks before deploying to production. The SAP Basis Team should use tools such as `sysstat`, `KSAR`, and `nmon` to verify if CPU and other performance parameters are impacted. 
 
 ## Prerequisites for deploying Microsoft Defender for Endpoint on Linux on SAP VMs
 
@@ -57,32 +57,34 @@ Conventional security defenses that have been commonly used to protect SAP syste
 - Microsoft Defender for Endpoint on Linux requires connectivity to [specific Internet endpoints](microsoft-defender-endpoint-linux.md#network-connections) from VMs to update antivirus Definitions.
 - Microsoft Defender for Endpoint on Linux requires some crontab (or other task scheduler) entries to schedule scans, log rotation, and Microsoft Defender for Endpoint updates. Enterprise Security teams normally manage these entries. Refer to [How to schedule an update of the Microsoft Defender for Endpoint (Linux)](linux-update-mde-linux.md).
 
-The default configuration option for deployment as an Azure Extension for AntiVirus (AV) will be Passive Mode. This means that the AV component of Microsoft Defender for Endpoint won't intercept IO calls. It's recommended to run Microsoft Defender for Endpoint in Passive Mode on all SAP applications and to schedule a scan once per day. In this mode:
+The default configuration option for deployment as an Azure Extension for AntiVirus (AV) is Passive Mode. This means that Microsoft Defender Antivirus, the AV component of Microsoft Defender for Endpoint, doesn't intercept IO calls. It's recommended to run Microsoft Defender for Endpoint in Passive Mode on all SAP applications and to schedule a scan once per day. In this mode:
 
 - **Real-time protection is turned off**: Threats aren't remediated by Microsoft Defender Antivirus.
 - **On-demand scanning is turned on**: Still use the scan capabilities on the endpoint.
 - **Automatic threat remediation is turned off**: No files are moved and the security administrator is expected to take required action.
 - **Security intelligence updates are turned on**: Alerts are available on security administrator's tenant.
 
+Online Kernel patching tools such as Ksplice or similar can lead to unpredictable OS stability if Defender for Endpoint is running. It is recommended to temporarily stop the Defender for Endpoint daemon prior to performing online Kernel patching. After the Kernel is updated Defender for Endpoint on Linux can be safely restarted. This is especially important on large SAP HANA VMs with huge memory contexts.
+
 The Linux crontab is typically used to schedule Microsoft Defender for Endpoint AV scan and log rotation tasks:
 [How to schedule scans with Microsoft Defender for Endpoint (Linux)](linux-schedule-scan-mde.md)
 
 Endpoint Detection and Response (EDR) functionality is active whenever Microsoft Defender for Endpoint on Linux is installed. There's no simple way to disable EDR functionality through command line or configuration. For more information on troubleshooting EDR, see the sections [Useful Commands](#useful-commands) and [Useful Links](#useful-links).
 
 ## Important Configuration Settings for Microsoft Defender for Endpoint on SAP on Linux  
 
-It's recommended to check the installation and configuration of Defender for Endpoint with the command mdatp health.
+It's recommended to check the installation and configuration of Defender for Endpoint with the command `mdatp health`.
 
 The key parameters recommended for SAP applications are:
 
-- healthy = true
-- release_ring = Production. Prerelease and insider rings shouldn't be used with SAP Applications.
-- real_time_protection_enabled = false. Real-time protection is off in passive mode, which is the default mode and prevents real-time IO interception.
-- automatic_definition_update_enabled = true
-- definition_status = "up_to_date".  Run a manual update if a new value is identified.
-- edr_early_preview_enabled = "disabled". If enabled on SAP systems it might lead to system instability.
-- conflicting_applications = [ ]. Other AV or security software installed on a VM such as Clam.
-- supplementary_events_subsystem = "ebpf".  Don't proceed if ebpf isn't displayed. Contact the security admin team.
+- `healthy = true`
+- `release_ring = Production`. Prerelease and insider rings shouldn't be used with SAP Applications.
+- `real_time_protection_enabled = false`. Real-time protection is off in passive mode, which is the default mode and prevents real-time IO interception.
+- `automatic_definition_update_enabled = true`
+- `definition_status = "up_to_date"`.  Run a manual update if a new value is identified.
+- `edr_early_preview_enabled = "disabled"`. If enabled on SAP systems it might lead to system instability.
+- `conflicting_applications = [ ]`. Other AV or security software installed on a VM such as Clam.
+- `supplementary_events_subsystem = "ebpf"`.  Don't proceed if ebpf isn't displayed. Contact the security admin team.
 
 This article has some useful hints on troubleshooting installation issues for Microsoft Defender for Endpoint:
 [Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux](linux-support-install.md#installation-failed)