Wesley van TilburgandClaude Opus 5.5
111d3bea66
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 9s
Build containers / Prune old releases and tags (pull_request) Skipped
Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.
Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
81 lines
2.7 KiB
Bash
Executable File
81 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Intune custom compliance discovery script for Linux: is Microsoft Defender
|
|
# for Endpoint (mdatp) installed, onboarded, licensed and protecting?
|
|
#
|
|
# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
|
|
# defender-compliance.json in a Linux compliance policy (Custom compliance).
|
|
# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
|
|
# JSON on stdout to Intune, which evaluates it against the rules. Every setting
|
|
# is always emitted, so a missing or stopped Defender reads as non-compliant
|
|
# instead of as a script error.
|
|
|
|
MDATP=/usr/bin/mdatp
|
|
# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
|
|
# a root timer may save the fields in /run/mdatp-health (the fedora-intune
|
|
# image does). Used when under 20 minutes old, otherwise mdatp is asked.
|
|
SNAPSHOT=/run/mdatp-health
|
|
|
|
if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
|
|
raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
|
|
else
|
|
raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
|
|
fi
|
|
|
|
# Print one `mdatp health` field without quotes or a trailing " [managed]".
|
|
# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
|
|
field() {
|
|
raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
|
|
| sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
|
|
}
|
|
|
|
bool() {
|
|
[[ "$1" == true ]] && echo true || echo false
|
|
}
|
|
|
|
installed=false
|
|
running=false
|
|
healthy=false
|
|
licensed=false
|
|
onboarded=false
|
|
rtp=false
|
|
behavior_monitoring=false
|
|
cloud_protection=false
|
|
definitions_ok=false
|
|
definitions_age=-1
|
|
version=""
|
|
|
|
if [[ -x "${MDATP}" ]]; then
|
|
installed=true
|
|
if [[ "$(field healthy)" =~ ^(true|false)$ ]]; then
|
|
# The daemon answered.
|
|
running=true
|
|
healthy="$(bool "$(field healthy)")"
|
|
licensed="$(bool "$(field licensed)")"
|
|
rtp="$(bool "$(field real_time_protection_enabled)")"
|
|
[[ "$(field behavior_monitoring)" == enabled ]] && behavior_monitoring=true
|
|
cloud_protection="$(bool "$(field cloud_enabled)")"
|
|
[[ -n "$(field org_id)" ]] && onboarded=true
|
|
[[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
|
|
age="$(field definitions_updated_minutes_ago)"
|
|
[[ "${age}" =~ ^[0-9]+$ ]] && definitions_age=$(( age / 1440 ))
|
|
version="$(field app_version)"
|
|
version="${version//[^0-9A-Za-z._-]/}"
|
|
fi
|
|
fi
|
|
|
|
cat <<EOF
|
|
{
|
|
"DefenderInstalled": ${installed},
|
|
"DefenderRunning": ${running},
|
|
"DefenderHealthy": ${healthy},
|
|
"DefenderLicensed": ${licensed},
|
|
"DefenderOnboarded": ${onboarded},
|
|
"DefenderRealTimeProtection": ${rtp},
|
|
"DefenderBehaviorMonitoring": ${behavior_monitoring},
|
|
"DefenderCloudProtection": ${cloud_protection},
|
|
"DefenderDefinitionsUpToDate": ${definitions_ok},
|
|
"DefenderDefinitionsAgeDays": ${definitions_age},
|
|
"DefenderVersion": "${version}"
|
|
}
|
|
EOF
|