- Isebenzisa ukwakheka okulula okusekelwe ku-eBPF okugwema amamojula e-kernel ukunciphisa umthelela ekusebenzeni.
- Inikeza isivikelo esiphelele nge-EDR, i-antivirus yesizukulwane esilandelayo, kanye nokuphathwa kobuthakathaka okusekelwe ku-AI.
- Iyahambisana nokusatshalaliswa kwebhizinisi okukhulu njenge-Ubuntu, i-RHEL, i-Debian kanye ne-SUSE kuzakhiwo ze-x64 kanye ne-ARM64.
- Idinga i-Microsoft Defender ukuze uthole amalayisense ezinkampani ze-Endpoint Plan 2 noma okubhaliselwe kwe-Microsoft 365 E5/E7.
Cishe uqaphele ukuthi uhlelo lokuphepha lweMicrosoft seluthathe igxathu elikhulu phambili. Akusekho nje ukuvikela iWindows; basebenzise ithuluzi elinamandla elibizwa ngokuthi iMicrosoft Defender for Endpoint, elenzelwe ngqo imvelo yeLinux. Okuthakazelisa kakhulu ukuthi, nakuba abaningi bekubona njengokuhlola kokuphepha kwenkampani okulula, ithuluzi selishintshe ukuze limboze konke kusukela kumaseva amafu aqinile kakhulu kuya kwi-laptop yonjiniyela osebenza ekhaya, ngaleyo ndlela kuhlanganiswa uhlelo lobuchwepheshe lonke ngaphansi komyalo owodwa.
Lesi sinyathelo silula kodwa sinomgomo omkhulu: I-Microsoft ifuna ukukhulula amabhizinisi ekuhlanganiseni amathuluzi ayishumi ahlukene. Ngokuhlanganisa i-Linux kwipulatifomu yayo ye -XDR (Extended Detection and Response) , bavumela umphathi wezokuphepha ukuthi abone ukuthi kwenzekani emshinini we-Azure virtual, iseva ebonakalayo esebenzisa i-Red Hat, noma ikhompyutha yedeskithophu esebenzisa i-Ubuntu, konke kusuka kudeshibhodi ehlanganisiwe . Ake sibheke kabanzi ukuthi lolu hlelo lusebenza kanjani, ukuthi yimiphi imishini esekelayo, nokuthi lungavulwa kanjani futhi lusebenze kahle.
Yini engaphansi kwe-hood? Ukusebenza kanye namakhono
Ngokungafani nezinhlelo ze-antivirus zendabuko ezingase zizizwe njengomthwalo ohlelweni ngezinye izikhathi, i-Defender on Linux isebenzisa ukwakheka kwenzwa elula okusekelwe ku -eBPF (extended Berkeley Packet Filter) . Lokhu kubalulekile ngoba kusho ukuthi akudingeki ukuthi kufakwe amamojula e-kernel, okunciphisa kakhulu amathuba okuphahlazeka kwesistimu futhi kunciphise umthelela ekusebenzeni komshini.
Uhlelo luhlukaniswe ngokuyisisekelo ngamabhulokhi amathathu okuzivikela ayinhloko. Okokuqala, kukhona ukuvikelwa kwesizukulwane esilandelayo , okungagcini nje ngokubheka izimpawu zegciwane ezindala, kodwa kusebenzisa ukufunda komshini kanye nokuhlaziywa kokuziphatha ukuvimba i-malware ngesikhathi sangempela. Uma inqubo iqala ukuziphatha ngendlela exakile efana nokuhlasela kwe-ransomware , uhlelo luyayivimba.
Okwesibili, i-EDR iyaqala ukusebenza. Yilapho izinto ziba zimbi khona, njengoba uhlelo luqapha umsebenzi ukuze luthole ukuhlaselwa okungenamafayela noma ukufakwa kwememori. Ngenxa yobuhlakani be-Microsoft bokusongela kanye nokuhambisana nohlaka lwe -MITRE ATT&CK , abahlaziyi bangabona umugqa wesikhathi oqondile wokuhlaselwa futhi baphendule ngendlela eguquguqukayo, kungaba ngokususa ifayela elisolisayo noma ngokusebenzisa izikripthi zokulungisa kude.
Okokugcina, kukhona ukuphathwa kokuchayeka. I-Defender ihlola uhlelo ukuze ithole ubuthakathaka besofthiwe kanye nokungalungiselelwa kahle. Esikhundleni sokuba umphathi abukeze mathupha i-CVE ngayinye, ithuluzi libeka phambili izingozi ukuze wazi ukuthi yini okufanele uyilungise kuqala ukuze unciphise indawo yokuhlasela.
Imishini ehambisanayo kanye nezidingo zobuchwepheshe
Akuzona zonke izinsizakusebenza ze-Linux ezisebenzayo, kodwa uhlu lubanzi kakhulu. I-Microsoft yenze noma yikuphi ukusabalalisa okusebenza kuseva kuhambisana nedeskithophu ye-Linux (yize lokhu kwamuva kusesesidlangalaleni). Lokhu kubalulekile kubahleli bezinhlelo, abavame ukuphatha amalungelo aphezulu futhi bayisisulu esiyinhloko sabaduni.
- Ukusabalalisa okwamukelwe: Ihlanganisa ama-heavyweights afana ne-Red Hat Enterprise Linux (RHEL), i-CentOS, i-Ubuntu LTS (kusukela ku-16.04 kuya ku-24.04 nangaphezulu), i-Debian, i-SUSE Linux Enterprise, i-Oracle Linux, i-Fedora, i-Rocky Linux, i-Alma Linux, kanye ne-Mariner.
- Izakhiwo: Isekela amaprosesa womabili x64 (AMD64/EM64T) njengezanamuhla kakhulu I-ARM64.
- Izindawo zezithombe: Akunandaba ukuthi usebenzisa i-GNOME, i-KDE, noma enye; okubalulekile isisekelo sesistimu kanye nenguqulo ye- i-kernel.
Ngokuphathelene nehadiwe, ayidingi kakhulu. Ukuze i-ejenti isebenze kahle, udinga okungenani i-core eyodwa ye-CPU , i-1 GB ye-RAM, kanye nesikhala sediski esingaba ngu-2 GB. Kodwa-ke, uma unomthwalo womsebenzi onzima kakhulu, kuyalulekwa ukuthi wandise lawa manani ukuze ugweme izithiyo. Ngasohlangothini lwesofthiwe, kubalulekile ukuthi uhlelo lusebenzise i-systemd njengomphathi wesistimu, futhi uma ufuna ukusebenzisa ukuhlukaniswa kwedivayisi, kumele ube nama-iptables noma ama-nftables alungiselelwe.
Izinhlelo zamafayela kanye nenethiwekhi
Ukuvikelwa kwesikhathi sangempela kanye nokuskena (okusheshayo noma okugcwele) kusebenza ezinhlelweni zamafayela ezivamile. Kodwa-ke, kunohlu olude lokuskena okwenziwe ngokwezifiso olufaka izinketho ezifana ne-btrfs, ext2, ext3, ext4, xfs, nfs (v3 kanye ne-v4), kanye nezinhlelo ezithile kakhulu njenge -glusterfs noma i-ocfs2.
Ukuze i-ejenti ibike izinsongo ku-portal ye-Microsoft, idinga ukuxhumana okungenamthungo efwini . Lokhu kuhilela ukumisa kahle ama-firewall futhi, uma inkampani isebenzisa i-proxy, ivumela ukutholwa kwe-proxy engaguquki ukuze ithrafikhi engaziwa kuma-URL e-Microsoft ingavinjelwa.
Indlela Yokuqalisa Nokusebenza: Izindlela Zokusebenzisa
Ukufaka i-Defender akulula njengokuchofoza inkinobho ethi "elandelayo", njengoba kuyithuluzi lezinga lebhizinisi. Nakuba ukufakwa ngesandla kungenzeka, ekusetshenzisweni okukhulu, kunconywa ukusebenzisa i -Deployment Tool noma abaphathi bokucushwa njenge -Puppet, i-Ansible, noma i-Chef.
Uma ukhetha umzila osetshenziswa ngesandla, inqubo iyahlukahluka kuye ngokusatshalaliswa kwakho. Kumasistimu asekelwe ku-RHEL, uzosebenzisa i-dnf noma i-yum ukwengeza indawo yokugcina idatha ye-Microsoft bese ufaka iphakheji ye-mdatp . Ku-Ubuntu noma ku-Debian, inqubo ihilela ukusebenzisa i-apt , ukumisa uhlu lwendawo yokugcina idatha kanye nezinkinobho ze-GPG ezihambisanayo.
Uma isofthiwe isifakiwe, kuza isinyathelo esibalulekile: ukungenisaUdinga ukulanda iphakheji kusuka ku-portal ye-Microsoft Defender bese usebenzisa iskripthi se-Python (ngokuvamile MicrosoftDefenderATPOnboardingLinuxServer.py) ngamalungelo empande. Ukuqinisekisa ukuthi konke kusebenza kahle, ungasebenzisa umyalo mdatp healthokuzokutshela ukuthi ngabe i-ejenti enempilo futhi enelayisensi.
Ukuphathwa kwelayisensi kanye nokusebenza
Kubalulekile ukucacisa ukuthi lokhu akuyona into yamahhala kubasebenzisi basekhaya. Ukuze usebenzise i-Defender ku-Linux, udinga ilayisense yenkampani, ikakhulukazi i-Microsoft Defender ye-Endpoint Plan 2 , noma ukubhalisa ohlelweni oluphelele njenge- Microsoft 365 E5 noma i-E7.
Ukuphathwa kwenziwa kusukela efwini, lapho ungalungiselela khona ukukhishwa kwe-antivirus ukuvimbela isithwebuli ukuthi singanciphisi ijubane lezinhlelo zokusebenza ezibalulekile. Izibuyekezo zeplatifomu zenziwa njalo ngenyanga, futhi kubalulekile ukuhlala ezinguqulweni ezintathu zakamuva ukuze ugcine ukwesekwa. Ngaphezu kwalokho, uhlelo luvumela imodi yokungasebenzi , okusho ukuthi i-Defender ingahlala ndawonye nenye isofthiwe ye-antivirus yangaphandle ngaphandle kokungqubuzana, imane ibukele futhi ibike ngaphandle kokuvimba ngokuzenzakalelayo.
Lesi sixazululo siguqula ukuphepha kwe-Linux kube yisisombululo esilawulekayo nesichwepheshile, sisusa izindawo ezingacacile engqalasizinda yebhizinisi. Ngokuhlanganisa ukwakheka okusekelwe ku -eBPF nokuphathwa kwamafu okuphakathi, i-Microsoft iqinisekisa ukuvikelwa okuqhubekayo nokusebenzayo kwamaseva nezindawo zokusebenza, okukwazi ukuvimba yonke into kusukela ku-malware elula kuya ezinsongweni eziqhubekayo eziqhubekayo.