You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/deploy/capacity-planning.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ This article describes how to use the Microsoft Defender for Identity sizing too
11
11
12
12
While domain controller performance may not be affected if the server doesn't have required resources, the Defender for Identity sensor may not operate as expected. For more information, see [Microsoft Defender for Identity prerequisites](prerequisites.md).
13
13
14
-
The sizing tool measures the capacity needed for domain controllers only. There is no need to run it against AD FS / AD CS servers, as the performance impact on AD FS / AD CS servers is extremely minimal to not existent.
14
+
The sizing tool measures the capacity needed for domain controllers only. There is no need to run it against AD FS / AD CS / Entra Connect servers, as the performance impact on these servers is extremely minimal to not existent.
15
15
16
16
> [!TIP]
17
17
> By default, Defender for Identity supports up to 350 sensors. To install more sensors, contact Defender for Identity support.
@@ -47,17 +47,17 @@ Common results include:
47
47
48
48
|Result |Description |
49
49
|---------|---------|
50
-
|**Yes**| The sensor is supported on your server |
50
+
|**Yes**| The sensor is supported on your server.|
51
51
|**Yes, but additional resources required**| The sensor is supported on your server as long you add any specified missing resources. |
52
-
|**Maybe**| The current **Busy Packets/Second** value may be significantly higher at that point than average. Check the timestamps to understand the processes running at that time, and whether you can limit the bandwidth for those processes under normal circumstances. |
53
-
|**Maybe, but additional resources required**|The sensor may be supported on your server as long you add any specified missing resources, or the **Busy packets / Second** may be above 60K |
54
-
|**No**| The sensor isn't supported on your server. <br><br>The current **Busy Packets/Second** value may be significantly higher at that point than average. Check the timestamps to understand the processes running at that time, and whether you can limit the bandwidth for those processes under normal circumstances. |
55
-
|**Missing OS Data**| There was an issue reading the operating system data. Make sure the connection to your server is able to query WMI remotely. |
56
-
|**Missing Traffic Data**| There was an issue reading the traffic data. Make sure the connection to your server is able to query performance counters remotely. |
57
-
|**Missing RAM data**| There was an issue reading the RAM data. Make sure the connection to your server is able to query WMI remotely. |
52
+
|**Maybe**| The current **Busy Packets/sec** value may be significantly higher at that point than average. Check the timestamps to understand the processes running at that time, and whether you can limit the bandwidth for those processes under normal circumstances. |
53
+
|**Maybe, but additional resources required**|The sensor may be supported on your server as long you add any specified missing resources, or the **Busy packets/sec** may be above 60K.|
54
+
|**No**| The sensor isn't supported on your server. <br><br>The current **Busy Packets/sec** value may be significantly higher at that point than average. Check the timestamps to understand the processes running at that time, and whether you can limit the bandwidth for those processes under normal circumstances. |
55
+
|**Missing OS Data**| There was an issue reading the operating system data. Make sure the connection to your server is able to query WMI remotely. |
56
+
|**Missing Traffic Data**| There was an issue reading the traffic data. Make sure the connection to your server is able to query performance counters remotely. |
57
+
|**Missing RAM data**| There was an issue reading the RAM data. Make sure the connection to your server is able to query WMI remotely. |
58
58
|**Missing core data**| There was an issue reading the core data. Make sure the connection to your server is able to query WMI remotely. |
59
59
60
-
For example, the following image shows a set of results where the **Maybe** indicates that the **Busy Packets/Second** value is significantly higher at that point than average. Note that the **Display DC Times as UTC/Local** is set to *Local DC Time*. This setting helps highlight the fact that the values were taken at around 3:30 AM.
60
+
For example, the following image shows a set of results where the **Maybe** indicates that the **Busy Packets/sec** value is significantly higher at that point than average. Note that the **Display DC Times as UTC/Local** is set to *Local DC Time*. This setting helps highlight the fact that the values were taken at around 3:30 AM.
61
61
62
62
:::image type="content" source="../media/capacity-tool-maybe.png" alt-text="Screenshot of a capacity tool results showing Maybe values." lightbox="../media/capacity-tool-maybe.png":::
Copy file name to clipboardExpand all lines: ATPDocs/troubleshooting-using-logs.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.topic: how-to
9
9
10
10
The Defender for Identity logs provide insight into what each component of Microsoft Defender for Identity sensor is doing at any given point in time.
11
11
12
-
The Defender for Identity logs are located in a subfolder called **Logs** where Defender for Identity is installed; the default location is: **C:\Program Files\Azure Advanced Threat Protection Sensor\\**. In the default installation location, it can be found at: **C:\Program Files\Azure Advanced Threat Protection Sensor\version number\Logs**.
12
+
The Defender for Identity logs are located in a subfolder called **Logs** where Defender for Identity is installed; the default location is: `C:\Program Files\Azure Advanced Threat Protection Sensor`. In the default installation location, it can be found at: `C:\Program Files\Azure Advanced Threat Protection Sensor\version number\Logs`.
13
13
14
14
## Defender for Identity sensor logs
15
15
@@ -28,7 +28,7 @@ The Defender for Identity sensor has the following logs:
28
28
29
29
## Defender for Identity deployment logs
30
30
31
-
The Defender for Identity deployment logs are located in the temp directory of the user who installed the product. It will usually be found at **%USERPROFILE%\AppData\Local\Temp**. If it was deployed by a service, it might be found at **C:\Windows\Temp**.
31
+
The Defender for Identity deployment logs are located in the temp directory of the user who installed the product. Typically, you can find these logs at `%USERPROFILE%\AppData\Local\Temp`. If the deployment was performed by a service, the logs might be located in `C:\Windows\Temp` or `C:\Windows\SystemTemp`, depending on your Windows version and patch level.
-[Microsoft Defender for Servers](/azure/defender-for-cloud/integration-defender-for-endpoint)
29
29
30
-
Before you begin: Install unzip if it's not already installed.
30
+
## Introduction
31
31
32
-
The Chef components are already installed and a Chef repository exists (chef generate repo \<reponame\>) to store the cookbook that's used to deploy to Defender for Endpoint on Chef managed Linux servers.
32
+
This article talks about how to deploy Defender for Endpoint on Linux at scale with Chef using two methods:
33
33
34
-
You can create a new cookbook in your existing repository by running the following command from inside the cookbooks folder that is in your chef repository:
34
+
1. Install using installer script
35
+
2. Manually configuring the repositories for more granular control over the deployment
36
+
37
+
## Prerequisites
38
+
39
+
For a description of prerequisites and system requirements, see [Microsoft Defender for Endpoint on Linux](/defender-endpoint/microsoft-defender-endpoint-linux).
40
+
41
+
## Download the onboarding package
42
+
43
+
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com/) then navigate to **Settings** > **Endpoints** > **Device management** > **Onboarding**.
44
+
45
+
2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method.
46
+
47
+
3. Select **Download onboarding package** and save the file as `WindowsDefenderATPOnboardingPackage.zip`.
48
+
49
+
50
+
51
+
4. Extract the contents of the archive using the following command:
52
+
53
+
Command:
54
+
55
+
```
56
+
unzip WindowsDefenderATPOnboardingPackage.zip
57
+
```
58
+
59
+
The expected output is:
60
+
61
+
```
62
+
Archive: WindowsDefenderATPOnboardingPackage.zip
63
+
inflating: mdatp_onboard.json
64
+
```
65
+
66
+
## Create a directory structure
67
+
68
+
Before you begin, ensure the Chef components are already installed and a Chef repository (chef generate repo <reponame>) exists to store the cookbook that's used to deploy to Defender for Endpoint on Chef-managed Linux servers.
69
+
70
+
The following command creates a new folder structure for the new cookbook called **mdatp**. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
35
71
36
72
```bash
37
73
chef generate cookbook mdatp
38
74
```
39
75
40
-
This command creates a new folder structure for the new cookbook called mdatp. You can also use an existing cookbook if you already have one you'd like to use to add the Defender for Endpoint deployment into.
41
-
After the cookbook is created, create a files folder inside the cookbook folder that just got created:
76
+
After the cookbook is created, create a files folder inside the cookbook folder that you created:
42
77
43
78
```bash
44
79
mkdir mdatp/files
45
80
```
46
81
47
-
Transfer the Linux Server Onboarding zip file that can be downloaded from the Microsoft Defender portal to this new files folder.
48
-
49
-
[!INCLUDE [Defender for Endpoint repackaging warning](../includes/repackaging-warning.md)]
82
+
Copy `mdatp_onboard.json` to the `/tmp` folder.
50
83
51
-
On the Chef Workstation, navigate to the mdatp/recipes folder. This folder is created when the cookbook was generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the default.rb file:
84
+
On the Chef Workstation, navigate to the **mdatp/recipes** folder, which is automatically created when the cookbook is generated. Use your preferred text editor (like vi or nano) to add the following instructions to the end of the **default.rb** file then save and close the file:
52
85
53
-
- include_recipe '::onboard_mdatp'
54
86
- include_recipe '::install_mdatp'
55
87
56
-
Then save and close the default.rb file.
88
+
## Create a cookbook
89
+
90
+
A cookbook can be created through any of the following methods:
91
+
92
+
-[Using an installer script](linux-deploy-defender-for-endpoint-with-chef.md#create-a-cookbook-using-installer-script)
1. Download the installer bash script. Pull the [installer bash script](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh) from Microsoft GitHub Repository or use the following command to download it:
2. Create a new recipe file named **install_mdatp.rb** in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [GitHub](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_simplified.rb).
104
+
105
+
```bash
106
+
mdatp = "/etc/opt/microsoft/mdatp"
107
+
108
+
#Download the onboarding json from tenant, keep the same at specific location
109
+
onboarding_json = "/tmp/mdatp_onboard.json"
110
+
111
+
#Download the installer script from: https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/mde_installer.sh
112
+
#Place the same at specific location, edit this if needed
> The installer script also supports other parameters such as channel, realtime protection, version, etc. To selectfrom the list of available options, check help through the following command:
127
+
>```./mde_installer.sh --help```
57
128
58
-
Next create a new recipe file named install_mdatp.rb in the recipes folder and add this text to the file:
129
+
### Create a cookbook by manually configuring repositories
130
+
131
+
Create a new recipe file named **install_mdatp.rb**in the recipes folder `~/cookbooks/mdatp/recipes/install_mdatp.rb` and add the following text to the file. You can also download the file directly from [Github](https://github.com/microsoft/mdatp-xplat/blob/master/linux/installation/third_party_installation_playbooks/chef.install_mdatp_manual.rb).
59
132
60
133
```powershell
61
134
#Add Microsoft Defender
62
-
Repo
63
135
case node['platform_family']
64
136
when 'debian'
65
-
apt_repository 'MDAPRepo' do
137
+
apt_repository 'MDATPRepo'do
66
138
arch 'amd64'
67
139
cache_rebuild true
68
140
cookbook false
69
141
deb_src false
70
142
key 'BC528686B50D79E339D3721CEB3E94ADBE1229CF'
71
143
keyserver "keyserver.ubuntu.com"
72
-
distribution 'focal'
144
+
distribution 'jammy'
73
145
repo_name 'microsoft-prod'
74
146
components ['main']
75
-
trusted true
76
-
uri "https://packages.microsoft.com/config/ubuntu/20.04/prod"
147
+
uri "https://packages.microsoft.com/ubuntu/22.04/prod"
Make sure to update the path name to the location of the onboarding file.
121
-
To test deploy it on the Chef workstation, run ``sudo chef-client -z -o mdatp``.
122
-
After your deployment, you should consider creating and deploying a configuration file to the servers based on [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md).
123
-
After creating and testing your configuration file, you can put it into the `cookbook/mdatp/files` folder where you also placed the onboarding package. Then you can create a settings_mdatp.rb file in the mdatp/recipies folder and add this text:
124
-
125
-
```powershell
126
-
#Copy the configuration file
127
-
cookbook_file '/etc/opt/microsoft/mdatp/managed/mdatp_managed.json' do
To include this step as part of the recipe just add `include_recipe ':: settings_mdatp` to your default.rb file within the recipe folder.
186
+
>[!NOTE]
187
+
> You can modify the os distribution, distribution version number, channel (prod/insider-fast, insiders-slow) and repo name to match the version you're deploying to and the channel you'd like to deploy to. Run `chef-client --local-mode --runlist 'recipe[mdatp]'` to test the cookbook on the Chef workstation.
188
+
189
+
## Troubleshoot installation issues
190
+
191
+
To troubleshoot issues:
137
192
138
-
You can also use crontab to schedule automatic updates [Schedule an update for Microsoft Defender for Endpoint on Linux](linux-update-MDE-Linux.md).
193
+
1. For information on how to find the log that's generated automatically when an installation error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
139
194
140
-
Uninstall MDATP cookbook:
195
+
2. For information about common installation issues, see [Installation issues](/defender-endpoint/linux-support-install).
196
+
197
+
3. If the health of the device is `false`, see [Defender for Endpoint agent health issues](/defender-endpoint/health-status).
198
+
199
+
4. For product performance issues, see [Troubleshoot performance issues](/defender-endpoint/linux-support-perf).
200
+
201
+
5. For proxy and connectivity issues, see [Troubleshoot cloud connectivity issues](/defender-endpoint/linux-support-connectivity).
202
+
203
+
To get support from Microsoft, open a support ticket, and provide the log files created by using the [client analyzer](/defender-endpoint/run-analyzer-macos-linux).
204
+
205
+
## How to configure policies for Microsoft Defender on Linux
206
+
207
+
You can configure antivirus or EDR settings on your endpoints using any of the following methods:
208
+
209
+
- See [Set preferences for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-preferences).
210
+
- See [security settings management](/mem/intune/protect/mde-security-integration) to configure settings in the Microsoft Defender portal.
211
+
212
+
## Uninstall MDATP cookbook
213
+
214
+
To uninstall Defender, save the following as a cookbook `~/cookbooks/mdatp/recipes/uninstall_mdatp.rb`.
141
215
142
216
```powershell
143
217
#Uninstall the Defender package
@@ -159,4 +233,7 @@ then
159
233
end
160
234
end
161
235
```
236
+
237
+
To include this step as part of the recipe, add `include_recipe ':: uninstall_mdatp` to your `default.rb` file within the recipe folder. Ensure that you have removed the `include_recipe '::install_mdatp'` from the `default.rb` file.
238
+
162
239
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
0 commit comments