From 964c0b5ff71bc22a5c6c11c804868ccb8de9bcae Mon Sep 17 00:00:00 2001 From: MatiG Date: Tue, 2 Mar 2021 08:42:50 +0200 Subject: [PATCH] rephrase --- .../microsoft-defender-atp/linux-support-events.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md index 48fdc09227..80c68187b9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-events.md @@ -68,7 +68,7 @@ Microsoft Defender for Endpoint utilized `audit` framework from linux to track n service auditd start ``` -**On SLES 12 and 15** systems, SYSCALL auditing in `auditd` is disabled by default and can explain missing events. +**On SLES** systems, SYSCALL auditing in `auditd` might be disabled by default and can be accounted for missing events. 1. To validate that SYSCALL auditing is not disabeld, list the current audit rules: