Wesley van TilburgandClaude Opus 5.5
75c3b502d7
Himmelblau reports VERSION_ID from /etc/os-release as the device OS version, so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own os-release (bind-mounted in their mount namespace only) with VERSION_ID set to OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock VERSION_ID that toolbox, flatpak and dnf expect. Add an Intune custom compliance discovery script and rules for Microsoft Defender for Endpoint (installed, running, onboarded, licensed, healthy, real-time protection, definitions up to date). These are uploaded to Intune, not shipped in the image. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
103 lines
3.4 KiB
JSON
103 lines
3.4 KiB
JSON
{
|
|
"Rules": [
|
|
{
|
|
"SettingName": "DefenderInstalled",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender is not installed.",
|
|
"Description": "Microsoft Defender for Endpoint (mdatp) must be installed on this device."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderRunning",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender is not running.",
|
|
"Description": "The Microsoft Defender service (mdatp.service) is not responding. Restart the device or contact IT."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderOnboarded",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender is not onboarded.",
|
|
"Description": "This device is not onboarded to your organization's Microsoft Defender tenant. Contact IT."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderLicensed",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender is not licensed.",
|
|
"Description": "Microsoft Defender has no valid license on this device. Contact IT."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderHealthy",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender reports a problem.",
|
|
"Description": "Run 'mdatp health' to see the reported issues, or contact IT."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderRealTimeProtection",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Real-time protection is off.",
|
|
"Description": "Microsoft Defender real-time protection must be enabled."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SettingName": "DefenderDefinitionsUpToDate",
|
|
"Operator": "IsEquals",
|
|
"DataType": "Boolean",
|
|
"Operand": true,
|
|
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
|
"RemediationStrings": [
|
|
{
|
|
"Language": "en_US",
|
|
"Title": "Microsoft Defender definitions are out of date.",
|
|
"Description": "Connect the device to the network so Microsoft Defender can update its security intelligence."
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|