Skip to content

linux-update-mde-linux.md

Latest commit

 

History

History
242 lines (167 loc) · 4.91 KB

linux-update-mde-linux.md

File metadata and controls

242 lines (167 loc) · 4.91 KB

title: How to schedule an update for Microsoft Defender for Endpoint on Linux description: Learn how to schedule an update for Microsoft Defender for Endpoint on Linux to better protect your organization's assets. ms.service: defender-endpoint ms.author: painbar author: paulinbar ms.reviewer: gopkr ms.localizationpriority: medium audience: ITPro ms.collection:

  • m365-security
  • tier3
  • mde-linux ms.topic: how-to ms.subservice: linux search.appverid: met150 ms.date: 05/12/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2

Schedule an update for Microsoft Defender for Endpoint on Linux

To run an update on Microsoft Defender for Endpoint on Linux, see Deploy updates for Microsoft Defender for Endpoint on Linux.

Linux and Unix have a tool called crontab (similar to Task Scheduler) to be able to run scheduled tasks.

Prerequisite

Note

To get a list of all the time zones, run the following command: timedatectl list-timezones

Examples for timezones:

  • America/Los_Angeles
  • America/New_York
  • America/Chicago
  • America/Denver

To set the Cron job

Use the following commands:

Backup crontab entries

sudo crontab -l > /var/tmp/cron_backup_201118.dat

Note

In our example, 201118 == YYMMDD.

Tip

Do this before you edit or remove.

To edit the crontab, and add a new job as a root user:

sudo crontab -e

Note

The default editor is VIM.

You might see:

0 * * * * /etc/opt/microsoft/mdatp/logrorate.sh

And

0 2 * * sat /bin/mdatp scan quick>~/mdatp_cron_job.log

See Schedule scans with Microsoft Defender for Endpoint (Linux)

Press "Insert"

Add the following entries:

CRON_TZ=America/Los_Angeles

#!RHEL and variants (CentOS and Oracle Linux)

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo yum update mdatp -y >> ~/mdatp_cron_job.log

#!SLES and variants

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo zypper update mdatp >> ~/mdatp_cron_job.log

#!Ubuntu and Debian systems

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo apt-get install --only-upgrade mdatp >> ~/mdatp_cron_job.log

Note

In the previous examples, we specified 00 minutes, 6 a.m. (hour using the 24-hour format), any day of the month, any month, on Sundays. [$(date +\%d) -le 15] doesn't run unless it's equal or less than the 15th day (third week). This means the job runs at 6 a.m. every Sunday, but only if the day of the month is the 15th or earlier.

Press "Esc"

Type ":wq" w/o the double quotes.

Note

w == write, q == quit

To view your cron jobs, type sudo crontab -l

:::image type="content" source="media/update-MDE-linux-4634577.jpg" alt-text="update Defender for Endpoint on Linux.":::

To inspect cron job runs:

sudo grep mdatp /var/log/cron

To inspect the mdatp_cron_job.log

sudo nano mdatp_cron_job.log

For those who use Ansible, Chef, or Puppet

Use the following commands:

To set cron jobs in Ansible

cron - Manage cron.d and crontab entries

See https://docs.ansible.com/ansible/latest for more information.

To set crontabs in Chef

cron resource

See https://docs.chef.io/resources/cron/ for more information.

To set cron jobs in Puppet

Resource Type: cron

See https://puppet.com/docs/puppet/5.5/types/cron.html for more information.

Automating with Puppet: Cron jobs and scheduled tasks

See https://puppet.com/blog/automating-puppet-cron-jobs-and-scheduled-tasks/ for more information.

Additional information

To get help with crontab

man crontab

To get a list of crontab file of the current user

crontab -l

To get a list of crontab file of another user

crontab -u username -l

To back up crontab entries

crontab -l > /var/tmp/cron_backup.dat

Tip

Do this before you edit or remove.

To restore crontab entries

crontab /var/tmp/cron_backup.dat

To edit the crontab and add a new job as a root user

sudo crontab -e

To edit the crontab and add a new job

crontab -e

To edit other user's crontab entries

crontab -u username -e

To remove all crontab entries

crontab -r

To remove other user's crontab entries

crontab -u username -r

Explanation

+—————- minute (values: 0 - 59) (special characters: , - * /)  

| +————- hour (values: 0 - 23) (special characters: , - * /) 

| | +———- day of month (values: 1 - 31) (special characters: , - * / L W C)  

| | | +——- month (values: 1 - 12) (special characters: ,- * / )  

| | | | +—- day of week (values: 0 - 6) (Sunday=0 or 7) (special characters: , - * / L W C) 

| | | | |*****command to be executed