{
  "Rules": [
    {
      "SettingName": "DefenderInstalled",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender is not installed.",
          "Description": "Microsoft Defender for Endpoint (mdatp) must be installed on this device."
        }
      ]
    },
    {
      "SettingName": "DefenderRunning",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender is not running.",
          "Description": "The Microsoft Defender service (mdatp.service) is not responding. Restart the device or contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderOnboarded",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender is not onboarded.",
          "Description": "This device is not onboarded to your organization's Microsoft Defender tenant. Contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderLicensed",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender is not licensed.",
          "Description": "Microsoft Defender has no valid license on this device. Contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderHealthy",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender reports a problem.",
          "Description": "Run 'mdatp health' to see the reported issues, or contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderRealTimeProtection",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Real-time protection is off.",
          "Description": "Microsoft Defender real-time protection must be enabled."
        }
      ]
    },
    {
      "SettingName": "DefenderBehaviorMonitoring",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Behavior monitoring is off.",
          "Description": "Microsoft Defender behavior monitoring must be enabled. Update the device to the latest image or contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderCloudProtection",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Cloud-delivered protection is off.",
          "Description": "Microsoft Defender cloud-delivered protection must be enabled. Update the device to the latest image or contact IT."
        }
      ]
    },
    {
      "SettingName": "DefenderDefinitionsUpToDate",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Microsoft Defender definitions are out of date.",
          "Description": "Connect the device to the network so Microsoft Defender can update its security intelligence."
        }
      ]
    }
  ]
}