How to Implement Linux Endpoint Detection and Response (EDR) for Beginners

Rajamohan Rajendran
Feb 20
2 min read

Updated: Mar 9

Hey there, fellow tech enthusiasts! Today, let’s dive into the world of Linux Endpoint Detection and Response (EDR) with a focus on some handy commands that can help you keep your system secure. Whether you’re a seasoned pro or just starting out, these tips will help you get your EDR up and running smoothly.

Starting Up

First things first, let’s get that EDR service started. Just pop open your terminal and run:

sudo systemctl start mdatp

This command fires up the Microsoft Defender for Endpoint (mdatp). Once it’s running, you can perform a quick scan to check for any immediate threats:

sudo mdatp scan quick

If you want to do a more thorough check, go for a full scan:

sudo mdatp scan full

Real-Time Protection

To ensure your system is always protected, enable real-time protection with:

sudo mdatp config real-time-protection --value enabled

You can check the health of your EDR with:

sudo mdatp health

And if you want to gather some diagnostics, just run:

sudo mdatp diagnostic create

Scheduling Scans with Cron

Want to automate your scans? Let’s set up a cron job! Open your crontab with:

sudo crontab -e

Open crontab in vim:

sudo crontab -e

To enter insert mode and start typing, press:"i"

After making your changes, to save and quit:

First press ESC key to exit insert mode

Then type:":wq"

If nothing else works, this will force quit:":qa!"

Then, add these lines to schedule a quick scan every day at 2 AM and a full scan every Sunday at 3 AM:

# Quick scan every day at 2 AM 
 0 2 * * * /usr/bin/mdatp scan quick  
# Full scan every Sunday at 3 AM  
 0 3 * * 0 /usr/bin/mdatp scan full

Monitoring and Updates

Keep an eye on your EDR’s performance with:

sudo mdatp diagnostic real-time-protection-statistics

And don’t forget to update your definitions regularly:

sudo mdatp definitions update

Troubleshooting

If something seems off, check the logs:

sudo grep mdatp /var/log/syslog

And if you need to adjust any settings, like enabling behavior monitoring, use:

sudo mdatp config behavior_monitoring --value enabled

Wrapping Up

That’s a wrap on our quick tour of Linux EDR! Remember, keeping your system secure is an ongoing process. With these commands, you’ll be well on your way to maintaining a robust defense against threats. Happy scanning!