{"id":33515,"date":"2020-02-25T18:53:00","date_gmt":"2020-02-25T18:53:00","guid":{"rendered":"http:\/\/f571ad2e-4115-4cb3-90b4-60acc00884eb"},"modified":"2020-02-25T18:53:00","modified_gmt":"2020-02-25T18:53:00","slug":"microsoft-previews-microsoft-defender-atp-for-linux","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-previews-microsoft-defender-atp-for-linux\/","title":{"rendered":"Microsoft previews Microsoft Defender ATP for Linux"},"content":{"rendered":"
<\/div>\n

First thing is first, the new beta Microsoft Defender Advanced Threat Protection (ATP)<\/a> is not an antiviral program for Linux desktops. No, it’s an enterprise platform designed to help you prevent, detect, investigate, and respond to Linux server and network threats.<\/p>\n

Microsoft is showing up the first version of Defender ATP at the RSA Conference 2020 in San Francisco. It’s still not available for testing yet, but Microsoft promises you’ll be able to test it in the next few days.<\/p>\n

This program will be available on Red Hat Enterprise Linux (RHEL)<\/a> 7+, CentOS Linux<\/a> 7+, Ubuntu<\/a> 16.04 LTS or higher LTS, SUSE Linux Enterprise Server (SLES)<\/a> 12+, Debian<\/a> 9+, and Oracle Enterprise Linux<\/a> 7.<\/p>\n

On the servers, you can use its shell program to launch configure and manage the Defender agent. Once it’s running you can start scans and manage threats from it locally. You can also deploy and configure it using Puppet<\/a>, Ansible<\/a>, or manually using Bash commands<\/a>.<\/p>\n

To run it, you’ll need a Microsoft Defender ATP subscription. Your server must also have network access to the Microsoft Defender ATP portal. You must also enable the fanotify kernel option. This option is used for monitoring file-system events.<\/p>\n

Once in place, the program will relay the following information to the Microsoft Defender Security Center console:<\/p>\n

Antivirus alert information<\/strong><\/p>\n