mde baseline ansible

Microsoft Defender for Endpoint (MDE) Ansible 基線

使用 ansible 確保 MDE 在 Linux、MacOS 或 Windows 系統上安裝、設定並處於活動狀態

在您的清單中定義 mde 組

 % ansible-playbook mde-verify.yml

替代方案

• 使用 MDE 基線 Inspec 設定文件

已知的 MDE 設定問題

• Selinux 在 RHEL/Centos7 問題上強制執行。在 RHEL/Centos8 上工作

 Error : wdavdaemon[20263]: /opt/microsoft/mdatp/sbin/wdavdaemon: error while loading shared libraries: libwdavdaemon_core.so: cannot enable executable stack as shared object requires: Permission denied

為了解決這個問題

 $ sepolicy generate -n wdavdaemon --init /opt/microsoft/mdatp/sbin/wdavdaemon
Loaded plugins: product-id, subscription-manager
Created the following files:
wdavdaemon.te # Type Enforcement file
wdavdaemon.if # Interface file
wdavdaemon.fc # File Contexts file
wdavdaemon_selinux.spec # Spec file
wdavdaemon.sh # Setup Script
$ sudo audit2allow -i /var/log/audit/audit.log -M wdavdaemon
[pp file should have: allow unconfined_service_t self:process execstack;]
$ sudo semodule -i wdavdaemon.pp
$ sudo systemctl restart mdatp
$ systemctl status mdatp

• /var/opt/microsoft/mdatp 需要有 exec mount 標誌，替代選項是移動到相容位置

 $ sudo systemctl stop mdatp
$ sudo install -d -m 755 /usr/local/microsoft
$ sudo bash -c 'mv /var/opt/microsoft/mdatp /usr/local/microsoft/ && ln -s /usr/local/microsoft/mdatp /var/opt/microsoft/'
$ sudo systemctl restart mdatp

這可能會解決健康問題：引擎 v1 不可用

• 分析器工具需要 Linux 上的 python3.7 和 perf。支援可以提供替代工具而不需要 python3

• 預設分析器 zip 不支援 RHEL/Centos 6. 達到對適當軟體包的支持

參考

• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-with-ansible，https://github.com/MicrosoftDocs/microsoft-365-docs/blob/公用/microsoft-365/security/defender-endpoint/linux-install-with-ansible.md
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-with-puppet
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-deploy-defender-for-endpoint-with-chef
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-linux
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/health-status 如果定義未自動更新，請嘗試手動更新

 mdatp definitions update

• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-support-connectivity
• https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-support-perf 部分效能影響可能與auditd有關，通常的路徑是從auditd覆蓋範圍中排除匹配的二進制文件，要么使用支援工具，要么直接在auditd規則中。