deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 11:53:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update linux-support-events.md

Browse Source
This commit is contained in:
jcaparas
2021-01-04 10:41:37 -08:00
committed by GitHub
parent 34914b978b
commit 6a3ab419c5
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md
View File

@ -29,12 +29,12 @@ ms.topic: conceptual
This article provides some general steps to mitigate missing events or alerts in the [security center](https://securitycenter.windows.com/) portal.
Once MDE had been installed properly on a device, a device page will be generated in the portal and _File_, _Process_, _Network_ and other events should appear in the timeline and advanced hunting pages.
Once Microsoft Defender for Endpoint has been installed properly on a device, a device page will be generated in the portal and _File_, _Process_, _Network_ and other events should appear in the timeline and advanced hunting pages.
In case events are not appearing or some types of events are missing, that could indicate some problem.
## Missing network and login events
MDE utilized `audit` framework from linux to track network and login activity.
Microsoft Defender for Endpoint utilized `audit` framework from linux to track network and login activity.
1. Make sure audit framework is working.
@ -75,7 +75,7 @@ MDE utilized `audit` framework from linux to track network and login activity.
sudo auditctl -l
```
if the following line is present, please remove it or edit it to enable MDE to track specific SYSCALLs.
if the following line is present, please remove it or edit it to enable Microsoft Defender for Endpoint to track specific SYSCALLs.
```output
-a task, never