To update Microsoft Defender for Endpoint on Linux, refer to Deploy updates for Microsoft Defender for Endpoint on Linux. Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. How to update Microsoft Defender for Endpoint on Linux Adding your interception certificate to the global store will not allow for interception.įor troubleshooting steps, see Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux. Configure an exception for SSL inspection and your proxy server to directly pass through data from Defender for Endpoint on Linux to the relevant URLs without interception. SSL inspection and intercepting proxies are also not supported for security reasons. Ensure that only a static proxy or transparent proxy is being used. PAC, WPAD, and authenticated proxies are not supported. Spreadsheet of specific DNS records for service locations, geographic locations, and OS for Gov/GCC/DoD customers. Microsoft Defender for Endpoint URL list for Gov/GCC/DoD

Spreadsheet of specific DNS records for service locations, geographic locations, and OS for commercial customers. Microsoft Defender for Endpoint URL list for commercial customers

If there are, you may need to create an allow rule specifically for them. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. When adding exclusions to Microsoft Defender Antivirus, you should be mindful of Common Exclusion Mistakes for Microsoft Defender Antivirus Network connections

Events added by Microsoft Defender for Endpoint on Linux will be tagged with mdatp key. System events captured by rules added to /etc/audit/rules.d/ will add to audit.log(s) and might affect host auditing and upstream collection. Red Hat Enterprise Linux 6 and CentOS 6:.The fanotify kernel option must be enabled.With a minimal requirement for the kernel version to be at or above 3.10.0-327. Microsoft Defender for Endpoint for all other supported distributions and versions is kernel-version-agnostic. See the list below for the list of supported kernels. You must verify that the kernel version is supported before updating to a newer kernel version. Microsoft Defender for Endpoint on Red Hat Enterprise Linux and CentOS - 6.7 to 6.10 is a Kernel based solution.

Checkpoint linux client