微软为 Linux 服务器添加了保护
微软 安全

> 
> 微软基于服务器的 Linux 保护计划的公开预览现在提供了改进的端点检测和响应功能。
> 
> 
> 


![](/data/attachment/album/202011/20/115338f382metmwx2zeczn.jpg)


我知道你们中的一些人还很难接受，但微软最近确实在支持 Linux。一个案例是：早在 6 月份，微软就发布了面向 Linux 的 [Microsoft Defender Advanced Threat Protection（ATP）](https://www.zdnet.com/article/microsoft-releases-defender-atp-for-linux/)，供普通用户使用。现在，微软改进了 Linux 版本的 Microsoft Defender，[公开预览版增加了端点检测和响应（EDR）功能](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-available-in-public-preview/ba-p/1890536)。


这并不是一个你可以在独立的 Linux 桌面上运行的 Microsoft Defender 版本。它的主要工作仍然是保护 Linux 服务器免受服务器和网络威胁。如果你想为你的独立桌面提供保护，可以使用 [ClamAV](https://www.clamav.net/) 或 [Sophos Antivirus for Linux](https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx) 等程序。


但对于企业来说，由于现在在家上班的人在各种地方使用他们的 Mac 和 Windows PC，这就是另外一个需求了。虽然基于 Linux 服务器，但你能够使用它来[保护运行 macOS、Windows 8.1 和 Windows 10 的 PC](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/secure-your-remote-workforce-with-microsoft-defender-atp/ba-p/1271806)。


通过这些新的 EDR 功能，Linux Defender 用户可以检测到涉及 Linux 服务器的高级攻击，利用丰富的经验，并快速补救威胁。这是在现有的[预防性防病毒功能](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-for-linux-is-now-generally-available/ba-p/1482344)和通过 Microsoft Defender 安全中心提供的集中报告基础上发展起来的。


具体来说，它包括：


* 丰富的调查体验，包括机器时间线、进程创建、文件创建、网络连接、登录事件和高级狩猎。
* 在编译过程和大型软件部署中优化了性能增强的 CPU 利用率。
* 上下文反病毒检测。就像 Windows 版一样，你可以深入了解威胁的来源以及恶意进程或活动是如何创建的。


要运行更新后的程序，你需要以下 Linux 服务器之一：RHEL 7.2+、CentOS Linux 7.2+、Ubuntu 16.04 或更高的 LTS 版本、SLES 12+、Debian 或更高版本、或 Oracle Linux 7.2。


接下来，要尝试这些公共预览功能，你需要在 Microsoft Defender 安全中心里打开预览功能。在这样做之前，请确保你运行的是 101.12.99 或更高版本。你可以通过命令找出你正在运行的版本：



```
mdatp health
```

在任何情况下，你都不应该将在 Linux 上运行 Microsoft Defender for Endpoint 的所有服务器都切换到预览模式。相反，微软建议你仅将部分 Linux 服务器配置为预览模式，使用以下命令切换：



```
$ sudo mdatp edr early-preview enable 
```

这样做了之后，如果你觉得自己很勇敢，想亲自看看它是否有效，微软提供了一种运行模拟攻击的方法。要做到这一点，请按照下面的步骤在你的 Linux 服务器上模拟检测，并调查情况：


* 验证在场的 Linux 服务器是否出现在 Microsoft Defender 安全中心中。如果这是该机器的第一次上线，可能需要长达 20 分钟才能出现。
* 从 [aka.ms/LinuxDIY](https://aka.ms/LinuxDIY) 这里下载并解压脚本文件到已在场的 Linux 服务器上，并运行以下命令：`./mde_linux_edr_diy.sh`。
* 几分钟后，应该会在 Microsoft Defender 安全中心发出警报。
* 查看警报详情、机器时间线，并执行典型的调查步骤。


祝你好运！




---


via: <https://www.zdnet.com/article/microsoft-defender-for-linux-adds-new-security-feature/> 


作者：[Steven J. Vaughan-Nichols](https://www.zdnet.com/meet-the-team/us/steven-j-vaughan-nichols/) 译者：[wxy](https://github.com/wxy) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](/article-12842-1.html) 荣誉推出


OK
# Microsoft Defender for Linux adds new security feature

![steven-vaughan-nichols](https://www.zdnet.com/a/img/resize/e27b3953df87b835a77deeeec01f311aa283a5ec/2022/08/05/e2171bd1-84f6-4ca8-9801-2abdeb61a365/steven-vaughan-nichols.jpg?auto=webp&fit=crop&frame=1&height=192&width=192)

I know it's still hard for some of you to wrap your minds around it, but Microsoft really does support Linux these days. A case in point: Back in June, Microsoft released [Microsoft Defender Advanced Threat Protection (ATP) for Linux for general use](https://www.zdnet.com/article/microsoft-releases-defender-atp-for-linux/). Now, Microsoft has improved the Linux version of Defender, by adding a [public preview of endpoint detection and response (EDR) capabilities](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-available-in-public-preview/ba-p/1890536).

This is still not a version of Microsoft Defender you can run on a standalone Linux desktop. Its primary job remains to protect Linux servers from server and network threats. If you want protection for your standalone desktop, use such programs as [ClamAV](https://www.clamav.net/) or [Sophos Antivirus for Linux](https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx).

For businesses, though, with workers from home now using their Macs and Windows PCs here, there, and everywhere, it's a different story. While based on Linux servers, you'll be able to use it to [protect PCs running macOS, Windows 8.1, and Windows 10](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/secure-your-remote-workforce-with-microsoft-defender-atp/ba-p/1271806).

With these new EDR capabilities, Linux Defender users can detect advanced attacks that involve Linux servers, utilize rich experiences, and quickly remediate threats. This builds on the existing [preventative antivirus capabilities](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-for-linux-is-now-generally-available/ba-p/1482344) and centralized reporting available via the Microsoft Defender Security Center.

Specifically, it includes:

- Rich investigation experience, which includes machine timeline, process creation, file creation, network connections, login events, and advanced hunting.
- Optimized performance-enhanced CPU utilization in compilation procedures and large software deployments.
- In-context AV detection. Just like with the Windows edition, you'll get insight into where a threat came from and how the malicious process or activity was created.

To run the updated program, you'll need one of the following Linux servers: RHEL 7.2+; CentOS Linux 7.2+; Ubuntu 16.04 or higher LTS; SLES 12+; Debian or higher; or Oracle Linux 7.2.

Next, to try these public preview capabilities, you'll need to turn on the[ preview features in Microsoft Defender Security Center.](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/preview) Before you do this, make sure you're running version 101.12.99 or higher. You can find out which version you're running with the command:

mdatp health


You shouldn't switch all your servers running Microsoft Defender for Endpoint on Linux to the preview in any case. Instead, Microsoft recommends you configure only some of your Linux servers to Preview mode, with the following command:

$ sudo mdatp edr early-preview enable


Once that's done, if you're feeling brave and want to see for yourself if it works, Microsoft is offering a way to run a simulated attack. To do this, follow the steps below to simulate a detection on your Linux server and investigate the case.


Verify that the onboarded Linux server appears in Microsoft Defender Security Center. If this is the first onboarding of the machine, it can take up to 20 minutes until it appears.

Download and extract the script file from here aka.ms/LinuxDIY to an onboarded Linux server and run the following command:



./mde_linux_edr_diy.shAfter a few minutes, it should be raised in Microsoft Defender Security Center.

Look at the alert details, machine timeline, and perform your typical investigation steps.


Good luck!

**Related Stories:**

[Editorial standards](/editorial-guidelines/)