Wesley van TilburgandClaude Opus 5.5
75c3b502d7
Himmelblau reports VERSION_ID from /etc/os-release as the device OS version, so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own os-release (bind-mounted in their mount namespace only) with VERSION_ID set to OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock VERSION_ID that toolbox, flatpak and dnf expect. Add an Intune custom compliance discovery script and rules for Microsoft Defender for Endpoint (installed, running, onboarded, licensed, healthy, real-time protection, definitions up to date). These are uploaded to Intune, not shipped in the image. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
65 lines
2.0 KiB
Bash
Executable File
65 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Intune custom compliance discovery script for Linux: is Microsoft Defender
|
|
# for Endpoint (mdatp) installed, onboarded, licensed and protecting?
|
|
#
|
|
# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
|
|
# defender-compliance.json in a Linux compliance policy (Custom compliance).
|
|
# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
|
|
# JSON on stdout to Intune, which evaluates it against the rules. Every setting
|
|
# is always emitted, so a missing or stopped Defender reads as non-compliant
|
|
# instead of as a script error.
|
|
|
|
MDATP=/usr/bin/mdatp
|
|
|
|
# Print one `mdatp health` field without quotes or a trailing " [managed]".
|
|
# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
|
|
field() {
|
|
"${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
|
|
| sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
|
|
}
|
|
|
|
bool() {
|
|
[[ "$1" == true ]] && echo true || echo false
|
|
}
|
|
|
|
installed=false
|
|
running=false
|
|
healthy=false
|
|
licensed=false
|
|
onboarded=false
|
|
rtp=false
|
|
definitions_ok=false
|
|
definitions_age=-1
|
|
version=""
|
|
|
|
if [[ -x "${MDATP}" ]]; then
|
|
installed=true
|
|
if [[ "$(field healthy)" =~ ^(true|false)$ ]]; then
|
|
# The daemon answered.
|
|
running=true
|
|
healthy="$(bool "$(field healthy)")"
|
|
licensed="$(bool "$(field licensed)")"
|
|
rtp="$(bool "$(field real_time_protection_enabled)")"
|
|
[[ -n "$(field org_id)" ]] && onboarded=true
|
|
[[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
|
|
age="$(field definitions_updated_minutes_ago)"
|
|
[[ "${age}" =~ ^[0-9]+$ ]] && definitions_age=$(( age / 1440 ))
|
|
version="$(field app_version)"
|
|
version="${version//[^0-9A-Za-z._-]/}"
|
|
fi
|
|
fi
|
|
|
|
cat <<EOF
|
|
{
|
|
"DefenderInstalled": ${installed},
|
|
"DefenderRunning": ${running},
|
|
"DefenderHealthy": ${healthy},
|
|
"DefenderLicensed": ${licensed},
|
|
"DefenderOnboarded": ${onboarded},
|
|
"DefenderRealTimeProtection": ${rtp},
|
|
"DefenderDefinitionsUpToDate": ${definitions_ok},
|
|
"DefenderDefinitionsAgeDays": ${definitions_age},
|
|
"DefenderVersion": "${version}"
|
|
}
|
|
EOF
|