Microsoft's beefed-up take on Linux server security has hit general availability
(2021/01/12)
- Reference: 1610456405
- News link: https://www.theregister.co.uk/2021/01/12/microsoft_linux_edr/
- Source link:
After a few months in preview, Microsoft has made Defender Endpoint Detection and Response (EDR) [1]generally available for Linux servers.
Microsoft has extended its Defender product over multiple platforms throughout the last year or so, having shaved the "Windows" prefix from the system. Android, macOS, and iOS have all joined the party and Microsoft Defender for Endpoint turned up for Linux around six months ago.
[2]
The theory goes that administrators with a mixed network can onboard devices via the same portal and view alerts in what Microsoft describes as a "single pane of glass experience".
The EDR support enriches the capability with extra timeline features and enhancements to the advanced hunting tool. "Customers can use this capability," according to Microsoft, "to search for threats across Linux servers, exploring up to 30 days of raw data."
It's handy stuff for admins already familiar with the Windows experience and keeps procedures consistent. Users can include elements such as process and file creation in their investigations as well as gather insight into where a threat or malicious activity came from.
Six Linux distributions are supported at present: RHEL 7.2+, CentOS Linux 7.2+, Ubuntu 16 LTS (or higher LTS), SLES 12+, Debian 9+, and Oracle Linux 7.2. The platform can be deployed and configured with Puppet, Ansible, "or using your existing Linux configuration management tool."
There remains no love for a standalone Linux desktop at this stage; this is aimed squarely at servers, although there are no shortage of alternatives from vendors such as Sophos or F-Secure.
Users already running Microsoft Defender for Endpoint (Linux) will get the EDR capability with an agent update. Those who opted into the preview programme last year will also need to update the agent.
[3]
And, of course, Microsoft Defender for Endpoint (Linux) will require the Servers licence. ®
Get our [4]Tech Resources
[1] https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-generally-available/ba-p/2048539
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x250%7C300x252%7C300x600&tile=3&c=33X-3VqMqqAKdxbTil7T3jFgAAANA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x100%7C300x250%7C300x251&tile=4&c=44X-3VqMqqAKdxbTil7T3jFgAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://whitepapers.theregister.com/
Microsoft has extended its Defender product over multiple platforms throughout the last year or so, having shaved the "Windows" prefix from the system. Android, macOS, and iOS have all joined the party and Microsoft Defender for Endpoint turned up for Linux around six months ago.
[2]
The theory goes that administrators with a mixed network can onboard devices via the same portal and view alerts in what Microsoft describes as a "single pane of glass experience".
The EDR support enriches the capability with extra timeline features and enhancements to the advanced hunting tool. "Customers can use this capability," according to Microsoft, "to search for threats across Linux servers, exploring up to 30 days of raw data."
It's handy stuff for admins already familiar with the Windows experience and keeps procedures consistent. Users can include elements such as process and file creation in their investigations as well as gather insight into where a threat or malicious activity came from.
Six Linux distributions are supported at present: RHEL 7.2+, CentOS Linux 7.2+, Ubuntu 16 LTS (or higher LTS), SLES 12+, Debian 9+, and Oracle Linux 7.2. The platform can be deployed and configured with Puppet, Ansible, "or using your existing Linux configuration management tool."
There remains no love for a standalone Linux desktop at this stage; this is aimed squarely at servers, although there are no shortage of alternatives from vendors such as Sophos or F-Secure.
Users already running Microsoft Defender for Endpoint (Linux) will get the EDR capability with an agent update. Those who opted into the preview programme last year will also need to update the agent.
[3]
And, of course, Microsoft Defender for Endpoint (Linux) will require the Servers licence. ®
Get our [4]Tech Resources
[1] https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-generally-available/ba-p/2048539
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x250%7C300x252%7C300x600&tile=3&c=33X-3VqMqqAKdxbTil7T3jFgAAANA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x100%7C300x250%7C300x251&tile=4&c=44X-3VqMqqAKdxbTil7T3jFgAAANA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://whitepapers.theregister.com/
Re: MS security for Linux?
Danny 2
...like boxer shorts in a Helsinki sauna.
MS security for Linux?
That's like screen doors on a submarine.