This article is contributed. See the original author and article here.
Several customers have approached me on how to configure Splunk antivirus exclusions for processes, folders, and files within Microsoft Defender for Endpoint on RedHat Enterprise Linux. This quick reference article has been created to address this common question.
Note: This blog is in support of Microsoft Defender for Endpoint on Red Hat Enterprise Linux 7.9.
Disclaimer: This may not work on all versions of Linux. Linux is a third-party entity with its own potential licensing restrictions. This content is provided to assist our customers to better navigate integration with a 3rd party component or operating system, and as such, no guarantees are implied. Process and folder exclusions could potentially be harmful because such exclusions increase your organizational exposure to security risks.
- First let’s check if any file or folder exclusions are already configured on your RedHat Enterprise Linux clients by running the following command
mdatp exclusion list
- In the following example, we see that we do not have any exclusions configured for the device
[azureuser@redhat /]$ mdatp exclusion list
=====================================
No exclusions
=====================================
[azureuser@redhat /]$
- To review Microsoft Defender for Endpoint on Linux exclusions information, visit our public documentation.
- Splunk exclusions list is noted in their respective documentation.
- Here is a simplified list of the recommended exclusion from the link above:
version: | Directories to exclude: | Processes to exclude: |
Splunk Enterprise (*nix) | /opt/splunk ($SPLUNK_HOME) and all sub-directories | · bloom · btool · btprobe · bzip2 · cherryd · classify · exporttool · locktest · locktool · node · python* · splunk · splunkd · splunkmon · tsidxprobe · tsidxprobe_plo · walklex |
Splunk universal forwarder (*nix) | /opt/splunkforwarder ($SPLUNK_HOME) and all subdirectories | · Same as Splunk Enterprise (*nix) |
- To add an exclusion manually for a process running on RHEL 7.9, you need to run the following command:
mdatp exclusion process add –name [nameofprocess]
- Since we have 17 processes to exclude, we will have to run the command 17 times, one for each process.
sudo mdatp exclusion process add –name bloom
sudo mdatp exclusion process add –name btool
sudo mdatp exclusion process add –name btprobe
sudo mdatp exclusion process add –name bzip2
sudo mdatp exclusion process add –name cherryd
sudo mdatp exclusion process add –name classify
sudo mdatp exclusion process add –name exporttool
sudo mdatp exclusion process add –name locktest
sudo mdatp exclusion process add –name locktool
sudo mdatp exclusion process add –name node
sudo mdatp exclusion process add –name python*
sudo mdatp exclusion process add –name splunk
sudo mdatp exclusion process add –name splunkd
sudo mdatp exclusion process add –name splunkmon
sudo mdatp exclusion process add –name tsidxprobe
sudo mdatp exclusion process add –name tsidxprobe_plo
sudo mdatp exclusion process add –name walklex
[azureuser@redhat /]$ sudo mdatp exclusion process add –name bloom
Process exclusion added successfully
- Once we run through the 17 processes, we can check the exclusions list again.
[azureuser@redhat /]$ mdatp exclusion list
=====================================
Excluded process
Process name: bloom
—
Excluded process
Process name: btool
—
Excluded process
Process name: btprobe
—
Excluded process
Process name: bzip2
—
Excluded process
Process name: cherryd
—
Excluded process
Process name: classify
—
Excluded process
Process name: exporttool
—
Excluded process
Process name: locktest
—
Excluded process
Process name: locktool
—
Excluded process
Process name: node
—
Excluded process
Process name: python*
—
Excluded process
Process name: splunk
—
Excluded process
Process name: splunkd
—
Excluded process
Process name: splunkmon
—
Excluded process
Process name: tsidxprobe
—
Excluded process
Process name: tsidxprobe_plo
—
Excluded process
Process name: walklex
=====================================
[azureuser@redhat /]$
Note: Now that we have all 17 processes excluded. We can move on to the folder exclusions.
- To add folder exclusions manually for RedHat Enterprise Linux 7.9, you need to run the following commands:
sudo mdatp exclusion folder add –path “/opt/splunk/”
Note: This will exclude all paths and all sub directories under /opt/splunk.
[azureuser@redhat /]$ sudo mdatp exclusion folder add –path “/opt/splunk/”
Folder exclusion configured successfully
- We can check the folder exclusions list again and verify the folders are excluded.
[azureuser@redhat /]$ mdatp exclusion list
=====================================
[azureuser@redhat /]$ mdatp exclusion list
=====================================
Excluded folder
Path: “/opt/splunk/”
—
- Now that we have added the folder exclusions for the application and verified it with mdatp exclusion list we are good to go.
Hopefully this article provides you with added clarity around the common task of adding Splunk exclusions on Linux clients protected by Microsoft Defender for Endpoint on Linux.
Disclaimer
The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.
Recent Comments