Hardening Linux Endpoints for Microsoft Defender for Endpoint

Deploying Microsoft Defender for Endpoint on Linux servers is a solid first step, but the real security value comes from proper hardening. In this post, I'll walk through practical configurations that go beyond the default deployment to reduce your attack surface and improve detection coverage across your Linux estate.

Prerequisites

• Microsoft Defender for Endpoint deployed on Linux endpoints (RHEL, Ubuntu, SLES, or supported distros)

• Root or sudo access to the target systems

• Defender for Endpoint Plan 2 license

• Familiarity with Linux command line and systemd

• 
  

Step 1 – Enable Real-Time Protection and Behavior Monitoring

By default, some Linux deployments run with passive mode enabled. Verify and enable active protection:

sudo mdatp health --field real_time_protection_enabled
sudo mdatp config real-time-protection --value enabled
sudo mdatp config behavior-monitoring --value enabled

Confirm the changes:

sudo mdatp health

Look for healthy status on real-time protection and behavior monitoring.

Step 2 – Configure Cloud-Delivered Protection

Enable cloud-based detection to leverage Microsoft's threat intelligence:

sudo mdatp config cloud --value enabled
sudo mdatp config cloud-diagnostic --value enabled
sudo mdatp config cloud-automatic-sample-submission --value enabled

This ensures your endpoints benefit from the latest threat intelligence and can submit suspicious files for analysis.

Step 3 – Harden Exclusions and Scan Settings

Review and minimize exclusions. Many organizations over-exclude paths, creating blind spots:

sudo mdatp exclusion list

Remove unnecessary exclusions:

sudo mdatp exclusion path remove --path /path/to/excluded/folder

Configure scheduled scans for critical directories:

sudo mdatp scan custom --path /var/www --scan-type quick

Step 4 – Lock Down the MDE Configuration

Prevent unauthorized tampering with Defender settings using tamper protection. While Linux doesn't have the same UI-based tamper protection as Windows, you can enforce settings via mdatp_managed.json:

Create or edit /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:

{
  "antivirusEngine": {
    "enforcementLevel": "real_time",
    "behaviorMonitoring": "enabled",
    "cloudService": "enabled"
  },
  "cloudService": {
    "automaticSampleSubmission": "enabled",
    "diagnosticLevel": "required"
  }
}

Set restrictive permissions:

sudo chmod 644 /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
sudo chown root:root /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

Step 5 – Enable Audit Logging for MDE Events

Integrate Defender events with auditd or your SIEM:

sudo mdatp log level set --level info
sudo journalctl -u mdatp -f

Forward logs to Microsoft Sentinel or your logging infrastructure. Consider shipping journalctl output via rsyslog or Fluent Bit.

Step 6 – Restrict Network Communication

Defender for Endpoint requires outbound connectivity to Microsoft endpoints. Lock this down using firewall rules to prevent unauthorized traffic:

# Allow only required MDE endpoints
sudo iptables -A OUTPUT -d events.data.microsoft.com -j ACCEPT
sudo iptables -A OUTPUT -d winatp-gw-*.microsoft.com -j ACCEPT

Refer to Microsoft's official endpoint list and restrict by IP/FQDN where possible.

Step 7 – Validate Device Posture

Check overall health and onboarding status:

sudo mdatp health --field org_id
sudo mdatp health --field healthy

Review detection history:

sudo mdatp threat list

Troubleshooting

Real-time protection won't enable: Check for conflicting AV solutions. Defender for Endpoint on Linux doesn't always cleanly coexist with other endpoint protection products.

High CPU usage: Review exclusions and consider excluding high-I/O paths like /var/log or database directories, but do so judiciously.

Cloud connectivity issues: Verify proxy settings in /etc/opt/microsoft/mdatp/mdatp_onboard.json and ensure firewall rules permit traffic to Microsoft endpoints.

Hardening Considerations

• Principle of least privilege: Run MDE with minimal required permissions. Avoid running services as root where possible.

• SELinux or AppArmor: Enable and enforce mandatory access controls to contain mdatp processes.

• Log retention: Ship MDE logs off-host immediately; attackers often target local logs for evasion.

• Patch management: Keep the MDE agent updated. Subscribe to Microsoft's security advisories for Linux MDE updates.

• Configuration drift: Use Ansible, Puppet, or your CM tool to enforce mdatp_managed.json across your fleet.