You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Servers](/azure/defender-for-cloud/integration-defender-for-endpoint)
29
29
30
-
Before you begin: Install unzip if it's not already installed.
30
+
## Introduction
31
31
32
-
The Chef components are already installed and a Chef repository exists (chef generate repo \<reponame\>) to store the cookbook that's used to deploy to Defender for Endpoint on Chef managed Linux servers.
32
+
This article talks about how to deploy Defender for Endpoint on Linux at scale with Chef using two methods:
33
33
34
-
You can create a new cookbook in your existing repository by running the following command from inside the cookbooks folder that is in your chef repository:
34
+
1. Install using installer script
35
+
2. Manually configuring the repositories for more granular control over the deployment
36
+
37
+
## Prerequisites
38
+
39
+
For a description of prerequisites and system requirements, see [Microsoft Defender for Endpoint on Linux](/defender-endpoint/microsoft-defender-endpoint-linux).
40
+
41
+
## Download the onboarding package
42
+
43
+
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/) then navigate to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
44
+
45
+
2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method.
46
+
47
+
3. Select **Download onboarding package** and save the file as `WindowsDefenderATPOnboardingPackage.zip`.
48
+
49
+
50
+
51
+
4. Extract the contents of the archive using the following command:
52
+
53
+
Command:
54
+
55
+
```
56
+
unzip WindowsDefenderATPOnboardingPackage.zip
57
+
```
58
+
59
+
The expected output is:
60
+
61
+
```
62
+
Archive: WindowsDefenderATPOnboardingPackage.zip
63
+
inflating: mdatp_onboard.json
64
+
```
65
+
66
+
## Create a directory structure
67
+
68
+
Before you begin, ensure the Chef components are already installed and a Chef repository (chef generate repo <reponame>) exists to store the cookbook that's used to deploy to Defender for Endpoint on Chef-managed Linux servers.
69
+
70
+
The following command creates a new folder structure for the new cookbook called **mdatp**. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
35
71
36
72
```bash
37
73
chef generate cookbook mdatp
38
74
```
39
75
40
-
This command creates a new folder structure for the new cookbook called mdatp. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
41
-
After the cookbook is created, create a files folder inside the cookbook folder that just got created:
76
+
After the cookbook is created, create a files folder inside the cookbook folder that you created:
42
77
43
78
```bash
44
79
mkdir mdatp/files
45
80
```
46
81
47
-
Transfer the Linux Server Onboarding zip file that can be downloaded from the Microsoft Defender portal to this new files folder.
48
-
49
-
[!INCLUDE [Defender for Endpoint repackaging warning](../includes/repackaging-warning.md)]
82
+
Copy `mdatp_onboard.json` to the `/tmp` folder.
50
83
51
-
On the Chef Workstation, navigate to the mdatp/recipes folder. This folder is created when the cookbook was generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the default.rb file:
84
+
On the Chef Workstation, navigate to the **mdatp/recipes** folder, which is automatically created when the cookbook is generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the **default.rb** file then save and close the file:
52
85
53
-
- include_recipe '::onboard_mdatp'
54
86
- include_recipe '::install_mdatp'
55
87
56
-
Then save and close the default.rb file.
88
+
## Create a cookbook
89
+
90
+
A cookbook can be created through any of the following methods:
91
+
92
+
-[Using an installer script](linux-deploy-defender-for-endpoint-with-chef.md#create-a-cookbook-using-installer-script)
1. Download the installer bash script. Pull the [installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh) from Microsoft GitHub Repository or use the following command to download it:
2. Create a new recipe file named **install_mdatp.rb** in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [GitHub](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_simplified.rb).
104
+
105
+
```bash
106
+
mdatp = "/etc/opt/microsoft/mdatp"
107
+
108
+
#Download the onboarding json from tenant, keep the same at specific location
109
+
onboarding_json = "/tmp/mdatp_onboard.json"
110
+
111
+
#Download the installer script from: https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh
112
+
#Place the same at specific location, edit this if needed
> The installer script also supports other parameters such as channel, realtime protection, version, etc. To selectfrom the list of available options, check help through the following command:
127
+
>```./mde_installer.sh --help```
57
128
58
-
Next create a new recipe file named install_mdatp.rb in the recipes folder and add this text to the file:
129
+
### Create a cookbook by manually configuring repositories
130
+
131
+
Create a new recipe file named **install_mdatp.rb**in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [Github](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_manual.rb).
59
132
60
133
```powershell
61
134
#Add Microsoft Defender
62
-
Repo
63
135
case node['platform_family']
64
136
when 'debian'
65
-
apt_repository 'MDAPRepo' do
137
+
apt_repository 'MDATPRepo'do
66
138
arch 'amd64'
67
139
cache_rebuild true
68
140
cookbook false
69
141
deb_src false
70
142
key 'BC528686B50D79E339D3721CEB3E94ADBE1229CF'
71
143
keyserver "keyserver.ubuntu.com"
72
-
distribution 'focal'
144
+
distribution 'jammy'
73
145
repo_name 'microsoft-prod'
74
146
components ['main']
75
-
trusted true
76
-
uri "https://packages.microsoft.com/config/ubuntu/20.04/prod"
147
+
uri "https://packages.microsoft.com/ubuntu/22.04/prod"
Make sure to update the path name to the location of the onboarding file.
121
-
To test deploy it on the Chef workstation, run ``sudo chef-client -z -o mdatp``.
122
-
After your deployment, you should consider creating and deploying a configuration file to the servers based on [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md).
123
-
After creating and testing your configuration file, you can put it into the `cookbook/mdatp/files` folder where you also placed the onboarding package. Then you can create a settings_mdatp.rb file in the mdatp/recipies folder and add this text:
124
-
125
-
```powershell
126
-
#Copy the configuration file
127
-
cookbook_file '/etc/opt/microsoft/mdatp/managed/mdatp_managed.json' do
To include this step as part of the recipe just add `include_recipe ':: settings_mdatp` to your default.rb file within the recipe folder.
186
+
>[!NOTE]
187
+
> You can modify the os distribution, distribution version number, channel (prod/insider-fast, insiders-slow) and repo name to match the version you're deploying to and the channel you'd like to deploy to. Run `chef-client --local-mode --runlist 'recipe[mdatp]'` to test the cookbook on the Chef workstation.
188
+
189
+
## Troubleshoot installation issues
190
+
191
+
To troubleshoot issues:
137
192
138
-
You can also use crontab to schedule automatic updates [Schedule an update for Microsoft Defender for Endpoint on Linux](linux-update-MDE-Linux.md).
193
+
1. For information on how to find the log that's generated automatically when an installation error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
139
194
140
-
Uninstall MDATP cookbook:
195
+
2. For information about common installation issues, see [Installation issues](/defender-endpoint/linux-support-install).
196
+
197
+
3. If the health of the device is `false`, see [Defender for Endpoint agent health issues](/defender-endpoint/health-status).
198
+
199
+
4. For product performance issues, see [Troubleshoot performance issues](/defender-endpoint/linux-support-perf).
200
+
201
+
5. For proxy and connectivity issues, see [Troubleshoot cloud connectivity issues](/defender-endpoint/linux-support-connectivity).
202
+
203
+
To get support from Microsoft, open a support ticket, and provide the log files created by using the [client analyzer](/defender-endpoint/run-analyzer-macos-linux).
204
+
205
+
## How to configure policies for Microsoft Defender on Linux
206
+
207
+
You can configure antivirus or EDR settings on your endpoints using any of the following methods:
208
+
209
+
- See [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
210
+
- See [security settings management](/mem/intune/protect/mde-security-integration) to configure settings in the Microsoft Defender portal.
211
+
212
+
## Uninstall MDATP cookbook
213
+
214
+
To uninstall Defender, save the following as a cookbook `~/cookbooks/mdatp/recipes/uninstall_mdatp.rb`.
141
215
142
216
```powershell
143
217
#Uninstall the Defender package
@@ -159,4 +233,7 @@ then
159
233
end
160
234
end
161
235
```
236
+
237
+
To include this step as part of the recipe, add `include_recipe ':: uninstall_mdatp` to your `default.rb` file within the recipe folder. Ensure that you have removed the `include_recipe '::install_mdatp'` from the `default.rb` file.
238
+
162
239
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
Copy file name to clipboardExpand all lines: defender-office-365/quarantine-admin-manage-messages-files.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,10 +18,11 @@ ms.custom:
18
18
- seo-marvel-apr2020
19
19
description: Admins can learn how to view and manage quarantined messages for all users in Exchange Online Protection (EOP). Admins in organizations with Microsoft Defender for Office 365 can also manage quarantined files in SharePoint Online, OneDrive for Business, and Microsoft Teams.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
# Manage quarantined messages and files as an admin
@@ -308,7 +309,7 @@ In the **Release email to recipient inboxes** flyout that opens, configure the f
308
309
Selecting this option reveals the following options:
309
310
310
311
-**Allow this message**: If you select this option, allow entries are added to the [Tenant Allow/Block List](tenant-allow-block-list-about.md) for the sender and any related URLs or attachments in the message. The following options also appear:
311
-
-**Remove entry after**: The default value is **30 days**, but you can also select **1 day**, **7 days**, or a **Specific date** that's less than 30 days.
312
+
-**Remove entry after**: The default value is **45 days after last used date**, but you can also select **1 day**, **7 days**, **30 days**, or a **Specific date** that's less than 30 days.
312
313
-**Allow entry note**: Enter an optional note that contains additional information.
313
314
314
315
When you're finished on the **Release email to recipient inboxes** flyout, select **Release message**.
@@ -400,7 +401,7 @@ In the **Submit to Microsoft for analysis** flyout that opens, configure the fol
400
401
401
402
-**I've confirmed it's clean** (default): Select this option if you're sure that the message is clean, and then select **Next**. Then the following settings are available:
402
403
-**Allow this email**: If you select this option, allow entries are added to the [Tenant Allow/Block List](tenant-allow-block-list-about.md) for the sender and any related URLs or attachments in the message. The following options also appear:
403
-
-**Remove entry after**: The default value is **30 days**, but you can also select **1 day**, **7 days**, or a **Specific date** that's less than 30 days.
404
+
-**Remove entry after**: The default value is **45 days after last used date**, but you can also select **1 day**, **7 days**, **30 days**, or a **Specific date** that's less than 30 days.
404
405
-**Allow entry note**: Enter an optional note that contains additional information.
405
406
406
407
-**It appears clean**: Select this option if you're unsure and you want a verdict from Microsoft.
Copy file name to clipboardExpand all lines: defender-xdr/auditing.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,8 +2,7 @@
2
2
title: How to search the audit logs for actions performed by Defender Experts
3
3
ms.reviewer:
4
4
description: As a tenant administrator, you can use Microsoft Purview to search the audit logs for the actions Microsoft Defender Experts did in your tenant to perform their investigations
Copy file name to clipboardExpand all lines: defender-xdr/defender-experts-scoped-coverage.md
+12-8Lines changed: 12 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ ms.custom:
17
17
- cx-ti
18
18
- cx-dex
19
19
search.appverid: met150
20
-
ms.date: 12/19/2024
20
+
ms.date: 12/20/2024
21
21
---
22
22
23
23
# Scoped coverage in Microsoft Defender Experts for XDR
@@ -34,23 +34,27 @@ Devices and users that are out of scope won't be supported by Defender Experts.
34
34
35
35
## Using Defender Experts scoped coverage
36
36
37
-
Defender Experts create a predefined Microsoft Defender for Endpoint device group or a Microsoft Entra ID user group in the Microsoft Defender portal to which you can add devices and users, respectively. The default name assigned to the created device or user group begins with **Defender_Experts_Scoped_Coverage_**.
37
+
You can create a predefined Microsoft Defender for Endpoint device group or a Microsoft Entra ID user group in the Microsoft Defender portal to which you can add devices and users, respectively. The default name assigned to the created device or user group is:
38
38
39
-
:::image type="content" source="media/defender_scoped_devices.png" alt-text="Screenshot of Defender Experts Scoped devices." lightbox="media/defender_scoped_devices.png":::
39
+
-**Defender_Experts_Scoped_Coverage_Devices**
40
+
-**Defender_Experts_Scoped_Coverage_Users**
40
41
41
42
The devices and users you add to these groups are then considered as the set of assets that are in scope for this service.
42
43
43
-
> [!IMPORTANT]
44
-
> Defender Experts need **System administrator** permissions to create the device and user groups. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts)
45
-
>
46
-
> The device group must also be in the highest order of priority for the devices under it to be considered in scope. This is a known product limitation.
44
+
:::image type="content" source="media/defender_scoped_devices.png" alt-text="Screenshot of Defender Experts Scoped devices." lightbox="media/defender_scoped_devices.png":::
45
+
46
+
> [!NOTE]
47
+
> Defender Experts need **Security admin** permissions to create the device and user groups. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts)
48
+
49
+
> [!TIP]
50
+
> The device group should be in the highest order of priority for the devices under it, to be considered in scope. This is a known product limitation.
47
51
48
52
Currently, the service doesn't offer support to rename these predefined groups, so we recommend that you don't rename the created device or user group. It also doesn't support nested groups. The devices and users would have to be added individually to the groups created.
49
53
50
54
The following section lists down questions that you or your SOC team might have regarding scoped coverage:
51
55
52
56
1.**What aspects of the XDR service remain consistent with Defender Experts scoped coverage?**
53
-
- This service doesn't change our pricing structure. You still pay for Defender Experts service based on E5 (and servers, Microsoft Defender for Cloud, and Open XDR) for your desired user base.
57
+
- This service doesn't change our pricing structure. You still pay for Defender Experts service based on E5 (Microsoft Defender for Servers) for your desired user base.
54
58
- This service doesn't scope according to individual Microsoft Defender products and services (such as Defender for Endpoint, Microsoft Defender for Office 365, or Microsoft Defender for Cloud). That is, the minimum baseline for scoped coverage is still the E5 license.
55
59
- There's no change in permissions for analysts in Defender Experts for XDR. Defender Experts analysts will still have access to your entire tenant and not just the scoped assets.
0 commit comments