Microsoft Defender for Endpoint on Linux

Applies to:

• Microsoft Defender for Endpoint Plan 2
• Microsoft 365 Defender

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

This topic describes how to install, configure, update, and use Microsoft Defender for Endpoint on Linux.

How to install Microsoft Defender for Endpoint on Linux

Microsoft Defender for Endpoint for Linux includes antimalware and endpoint detection and response (EDR) capabilities.

Prerequisites

• Access to the Microsoft 365 Defender portal

• Linux distribution using the systemd system manager

  Note

  Linux distribution using system manager, except for RHEL/CentOS 6.x support both SystemV and Upstart.

• Beginner-level experience in Linux and BASH scripting

• Administrative privileges on the device (in case of manual deployment)

Installation instructions

There are several methods and deployment tools that you can use to install and configure Microsoft Defender for Endpoint on Linux.

In general you need to take the following steps:

• Ensure that you have a Microsoft Defender for Endpoint subscription.
• Deploy Microsoft Defender for Endpoint on Linux using one of the following deployment methods:
  • The command-line tool:
    • Manual deployment
  • Third-party management tools:
    • Deploy using Puppet configuration management tool
    • Deploy using Ansible configuration management tool
    • Deploy using Chef configuration management tool

If you experience any installation failures, refer to Troubleshooting installation failures in Microsoft Defender for Endpoint on Linux.

System requirements

• Supported Linux server distributions and x64 (AMD64/EM64T) and x86_64 versions:

  • Red Hat Enterprise Linux 6.7 or higher (Preview)

  • Red Hat Enterprise Linux 7.2 or higher

  • Red Hat Enterprise Linux 8.x

  • CentOS 6.7 or higher (Preview)

  • CentOS 7.2 or higher

  • Ubuntu 16.04 LTS or higher LTS

  • Debian 9 or higher

  • SUSE Linux Enterprise Server 12 or higher

  • Oracle Linux 7.2 or higher

  • Oracle Linux 8.x

  • Amazon Linux 2

  • Fedora 33 or higher

    Note

    Distributions and version that are not explicitly listed are unsupported (even if they are derived from the officially supported distributions).

• List of supported kernel versions

  Note

  Microsoft Defender for Endpoint on RHEL/CentOS - 6.7 to 6.10 is a Kernel based solution. You must verify that the kernel is the supported before updating to the newer kernel version. See the list below for the list of supported kernels. Microsoft Defender for Endpoint implementation for all other supported distributions and versions is kernel-version-agnostic. With minimal requirement for the kernel version to be on or above 3.10.0-327.

  • The fanotify kernel option must be enabled
  • Red Hat Enterprise Linux 6 and CentOS 6:

    • For 6.7: 2.6.32-573.*

    • For 6.8: 2.6.32-642.*

    • For 6.9: 2.6.32-696.* (except 2.6.32-696.el6.x86_64)

    • For 6.10: 2.6.32.754.2.1.el6.x86_64 to 2.6.32-754.47.1:

      • 2.6.32-754.10.1.el6.x86_64
      • 2.6.32-754.11.1.el6.x86_64
      • 2.6.32-754.12.1.el6.x86_64
      • 2.6.32-754.14.2.el6.x86_64
      • 2.6.32-754.15.3.el6.x86_64
      • 2.6.32-754.17.1.el6.x86_64
      • 2.6.32-754.18.2.el6.x86_64
      • 2.6.32-754.2.1.el6.x86_64
      • 2.6.32-754.22.1.el6.x86_64
      • 2.6.32-754.23.1.el6.x86_64
      • 2.6.32-754.24.2.el6.x86_64
      • 2.6.32-754.24.3.el6.x86_64
      • 2.6.32-754.25.1.el6.x86_64
      • 2.6.32-754.27.1.el6.x86_64
      • 2.6.32-754.28.1.el6.x86_64
      • 2.6.32-754.29.1.el6.x86_64
      • 2.6.32-754.29.2.el6.x86_64
      • 2.6.32-754.3.5.el6.x86_64
      • 2.6.32-754.30.2.el6.x86_64
      • 2.6.32-754.33.1.el6.x86_64
      • 2.6.32-754.35.1.el6.x86_64
      • 2.6.32-754.39.1.el6.x86_64
      • 2.6.32-754.41.2.el6.x86_64
      • 2.6.32-754.43.1.el6.x86_64
      • 2.6.32-754.47.1.el6.x86_64
      • 2.6.32-754.6.3.el6.x86_64
      • 2.6.32-754.9.1.el6.x86_64

• Disk space: 1 GB

• /opt/microsoft/mdatp/sbin/wdavdaemon requires executable permission. For more information, see "Ensure that the daemon has executable permission" in Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux.

• Cores: 2 minimum, 4 preferred

• Memory: 1 GB minimum, 4 preferred

  Note

  Please make sure that you have free disk space in /var.

• The solution currently provides real-time protection for the following file system types:

  • btrfs
  • ecryptfs
  • ext2
  • ext3
  • ext4
  • fuse
  • fuseblk
  • jfs
  • nfs
  • overlay
  • ramfs
  • reiserfs
  • tmpfs
  • udf
  • vfat
  • xfs

After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.

• Audit framework (auditd) must be enabled.

  Note

  System events captured by rules added to /etc/audit/rules.d/ will add to audit.log(s) and might affect host auditing and upstream collection. Events added by Microsoft Defender for Endpoint on Linux will be tagged with mdatp key.

Configuring Exclusions

When adding exclusions to Microsoft Defender Antivirus, you should be mindful of Common Exclusion Mistakes for Microsoft Defender Antivirus

Network connections

The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an allow rule specifically for them.

---

Defender for Endpoint can discover a proxy server by using the following discovery methods:

• Transparent proxy
• Manual static proxy configuration

If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. For transparent proxies, no additional configuration is needed for Defender for Endpoint. For static proxy, follow the steps in Manual Static Proxy Configuration.

For troubleshooting steps, see Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux.

How to update Microsoft Defender for Endpoint on Linux

Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender for Endpoint on Linux, refer to Deploy updates for Microsoft Defender for Endpoint on Linux.

How to configure Microsoft Defender for Endpoint on Linux

Guidance for how to configure the product in enterprise environments is available in Set preferences for Microsoft Defender for Endpoint on Linux.

Common Applications to Microsoft Defender for Endpoint can impact

High I/O workloads from certain applications can experience performance issues when Microsoft Defender for Endpoint is installed. These include applications for developer scenarios like Jenkins and Jira, and database workloads like OracleDB and Postgres. If experiencing performance degradation, consider setting exclusions for trusted applications, keeping Common Exclusion Mistakes for Microsoft Defender Antivirus in mind. For additional guidance, consider consulting documentation regarding antivirus exclusions from third party applications.

Resources

• For more information about logging, uninstalling, or other topics, see Resources.

Related articles

• Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint
• Connect your non-Azure machines to Microsoft Defender for Cloud