Misthios/bootc-images
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Misthios/defender onboarding validation #4

Merged
Misthios merged 2 commits from misthios/defender-onboarding-validation into main 2026-10-20 12:23:31 +00:00
Conversation 0 Commits 2 Files Changed 5
+83 -1
2 Commits
Author SHA1 Message Date
Wesley van TilburgandClaude Opus 5.5 ebe1d80f80 fedora-intune: enforce Defender protection settings
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Details
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Details
Build containers / Compute changes (pull_request) Canceled after 17s
Details
Build containers / Prune old releases and tags (pull_request) Skipped
Details 
Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 12:19:17 +00:00
Wesley van TilburgandClaude Opus 5.5 4213575206 fedora-intune: validate the onboarding JSON in the Defender script 
A paste into Intune that lost the first "{" line produced an unreadable
mdatp_onboard.json, and Defender reported "No license found". Check that
the pasted JSON parses and has onboardingInfo before writing it, and log
what to fix otherwise.

The placeholder also appeared twice, so a find-and-replace of it broke
the script; match it by prefix so it appears only once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-10-20 12:10:58 +00:00