Skip to content

Commit f55f4e9

Browse files
committed
Update microsoft-defender-endpoint-linux.md
1 parent 4f9d424 commit f55f4e9

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

defender-endpoint/microsoft-defender-endpoint-linux.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,8 @@ You can use one of the following methods to deploy Microsoft Defender for Endpoi
147147
If you experience any installation failures, see [Troubleshooting installation failures in Microsoft Defender for Endpoint on Linux](linux-support-install.md).
148148

149149
> [!IMPORTANT]
150-
> Installing Microsoft Defender for Endpoint in any location other than the default install path is not supported.
151-
> Microsoft Defender for Endpoint on Linux creates an `mdatp` user with random UID and GID. If you want to control the UID and GID, create an `mdatp` user prior to installation using the `/usr/sbin/nologin` shell option. Here's an example: `mdatp:x:UID:GID::/home/mdatp:/usr/sbin/nologin`.
150+
> Installing Microsoft Defender for Endpoint in any location other than the default install path isn't supported.
151+
> Microsoft Defender for Endpoint on Linux creates an `mdatp` user with random UID and GID. If you want to control the UID and GID, create an `mdatp` user before installation using the `/usr/sbin/nologin` shell option. Here's an example: `mdatp:x:UID:GID::/home/mdatp:/usr/sbin/nologin`.
152152
153153
### External package dependency
154154

@@ -159,16 +159,16 @@ If the Microsoft Defender for Endpoint installation fails due to missing depende
159159
- For DEBIAN the mdatp package requires `libc6 >= 2.23`, `uuid-runtime`, and `mde-netfilter`
160160

161161
> [!NOTE]
162-
> Starting with version `101.24082.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology.
163-
> If eBPF is not supported on your machines, or if there are specific requirements to remain on Auditd, and your machines are using Defender for Endpoint on Linux version `101.24072.0001` or lower, the following additional dependency on the auditd package exists for mdatp:
162+
> Beginning with version `101.24082.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology.
163+
> If eBPF isn't supported on your machines, or if there are specific requirements to remain on Auditd, and your machines are using Defender for Endpoint on Linux version `101.24072.0001` or older, the following additional dependency on the auditd package exists for mdatp:
164164
> - The mdatp RPM package requires `audit`, `semanage`.
165-
> - For DEBIAN the mdatp package requires `auditd`.
166-
> - For Mariner the mdatp package requires `audit`.
165+
> - For DEBIAN, the mdatp package requires `auditd`.
166+
> - For Mariner, the mdatp package requires `audit`.
167167
168168
The`mde-netfilter` package also has the following package dependencies:
169169

170-
- For DEBIAN the mde-netfilter package requires `libnetfilter-queue1`, and `libglib2.0-0`
171-
- For RPM the mde-netfilter package requires `libmnl`, `libnfnetlink`, `libnetfilter_queue`, and `glib2`
170+
- For DEBIAN, the mde-netfilter package requires `libnetfilter-queue1`, and `libglib2.0-0`
171+
- For RPM, the mde-netfilter package requires `libmnl`, `libnfnetlink`, `libnetfilter_queue`, and `glib2`
172172

173173
### Configuring Exclusions
174174

@@ -186,8 +186,8 @@ Defender for Endpoint on Linux can connect through a proxy server by using the f
186186
If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. For transparent proxies, no another configuration is needed for Defender for Endpoint. For static proxy, follow the steps in [Manual Static Proxy Configuration](linux-static-proxy-configuration.md).
187187

188188
> [!WARNING]
189-
> PAC, WPAD, and authenticated proxies are not supported. Ensure that only a static proxy or transparent proxy is being used.
190-
> SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Defender for Endpoint on Linux to the relevant URLs without interception. Adding your interception certificate to the global store will not allow for interception.
189+
> PAC, WPAD, and authenticated proxies aren't supported. Ensure that only a static proxy or transparent proxy is being used.
190+
> SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Defender for Endpoint on Linux to the relevant URLs without interception. Adding your interception certificate to the global store won't allow for interception.
191191
192192
For troubleshooting steps, see [Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux](linux-support-connectivity.md).
193193

0 commit comments

Comments
 (0)