From 92ee3a5b4a483750a21b5368bb5449f0e9b5a5be Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 12 Aug 2020 14:51:21 +0800 Subject: [PATCH 1/2] Code sweep --- .../microsoft-defender-atp/linux-exclusions.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md index 3c07af2507..45222d4fb1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md @@ -64,7 +64,7 @@ For more information on how to configure exclusions from Puppet, Ansible, or ano Run the following command to see the available switches for managing exclusions: ```bash -$ mdatp exclusion +mdatp exclusion ``` Examples: @@ -73,27 +73,35 @@ Examples: ```bash $ mdatp exclusion extension add --name .txt + ``` + ```Output Extension exclusion configured successfully ``` - Add an exclusion for a file: ```bash - $ mdatp exclusion file add --path /var/log/dummy.log + mdatp exclusion file add --path /var/log/dummy.log + ``` + ```Output File exclusion configured successfully ``` - Add an exclusion for a folder: ```bash - $ mdatp exclusion folder add --path /var/log/ + mdatp exclusion folder add --path /var/log/ + ``` + ```Output Folder exclusion configured successfully ``` - Add an exclusion for a process: ```bash - $ mdatp exclusion process add --name cat + mdatp exclusion process add --name cat + ``` + ```Output Process exclusion configured successfully ``` @@ -104,7 +112,7 @@ You can validate that your exclusion lists are working by using `curl` to downlo In the following Bash snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure that you run the command within that path. ```bash -$ curl -o test.txt https://www.eicar.org/download/eicar.com.txt +curl -o test.txt https://www.eicar.org/download/eicar.com.txt ``` If Microsoft Defender ATP for Linux reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html). From ae16a40fa2c2cfccc0b7e0b5268e18e3006191a9 Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 12 Aug 2020 14:56:48 +0800 Subject: [PATCH 2/2] Missed one $ prompt --- .../microsoft-defender-atp/linux-exclusions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md index 45222d4fb1..1f468cc2bf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md @@ -72,7 +72,7 @@ Examples: - Add an exclusion for a file extension: ```bash - $ mdatp exclusion extension add --name .txt + mdatp exclusion extension add --name .txt ``` ```Output Extension exclusion configured successfully