Deploy Microsoft Defender ATP with Ansible: automate the agent's installation and configuration across your fleet of Linux machines.
Real-world use case
You need to deploy Microsoft Defender ATP across a fleet of machines without spending hours on it: here's how to automate it with Ansible.
Microsoft Defender for Endpoint
Microsoft Defender helps block advanced threats; all the information is available on the vendor's website. As part of a project, I need to deploy Microsoft's built-in agents across several Linux systems. Let's see together how to simply and quickly deploy Microsoft Defender ATP for Endpoint protection on Ubuntu 22.04 (Jammy) using the Ansible tool. At the time of writing, the mdatp version is 101.68.80 and the Ubuntu LTS version is 22.04.
Playbook configuration:
As a reminder, we need to specify the server's address in the hosts.yml file before running the following configuration:
- name: "[MICROSOFT]"
hosts: all
tasks:
- name: "[MDATP-DIRECTORY]"
file:
path: /etc/opt/microsoft/mdatp/
recurse: true
state: directory
mode: 0755
owner: root
group: root
- name: "[REGISTER-ONBOARD]"
stat:
path: /etc/opt/microsoft/mdatp/mdatp_onboard.json
register: mdatp_onboard
- name: "[COPY-ONBOARD]"
copy:
src: ./destination/security/mdatp/mdatp_onboard.json
dest: /etc/opt/microsoft/mdatp/
owner: root
group: root
mode: 0600
- name: "[ADD-APT-KEY]"
apt_key:
url: https://packages.microsoft.com/keys/microsoft.asc
state: present
- name: "[ADD-REPOSITORY-JAMMY]"
apt_repository:
repo: deb [arch=amd64,armhf,arm64] https://packages.microsoft.com/ubuntu/22.04/prod jammy main
update_cache: yes
state: present
- name: "[INSTALL-MDATP]"
apt:
name: mdatp
state: latest
update_cache: yes
The playbook can be run against the host from a manager like this:
ansible-playbook -i hosts.yml -u my_user playbook-security.yml
Afterward, replace the value "my_user" with a user of your choice and also replace the "playbook-security.yml" file with the correct yaml file. The result should look like this:
PLAY RECAP *******************************************************************************************
MY_SERVER : ok=7 changed=7 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Here's how to check the deployment on the server with the following command:
mdatp health
healthy : true
health_issues : []
licensed : true
engine_version : "3.0"
app_version : "101.68.80"
org_id : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
log_level : "info"
machine_guid : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
release_ring : "Production"
product_expiration : Dec 31, 2022 at 12:00:00 AM
cloud_enabled : true
cloud_automatic_sample_submission_consent : "safe"
cloud_diagnostic_enabled : false
passive_mode_enabled : false
real_time_protection_enabled : true
real_time_protection_available : true
real_time_protection_subsystem : "fanotify"
supplementary_events_subsystem : "auditd"
tamper_protection : "disabled"
automatic_definition_update_enabled : true
definitions_updated : May 28, 2022 at 02:24:41 PM
definitions_updated_minutes_ago : 0
definitions_version : "87968"
definitions_status : "up_to_date"
edr_early_preview_enabled : "disabled"
edr_device_tags : []
edr_group_ids : ""
edr_configuration_version : "30.199999.7353798-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
edr_machine_id : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
conflicting_applications : []
network_protection_status : "stopped"
I now encourage you to get familiar with the tool and configure it in the best possible way. Here's more information in the vendor's documentation.