How does defender protect azure linux vms

Question

Azure Defender does not integrate with Azure services to monitor and protect your linux based machines. Then how does Security Center present the alerts and remediation suggestions from linux services. Say for instance that it uses auditd but how are we protecting linux through ASC?

Answer 1

anonymous user Thanks for reaching out.

Azure security center depends on log analytics agent to collect logs from the supported servers. Once you have the logs flowing in from the log agent by onboarding them from Azure security center portal we start getting the information.

Azure defender collects audit records from Linux machines by using auditd, one of the most common Linux auditing frameworks. auditd lives in the mainline kernel.

Auditd records are collected, enriched, and aggregated into events by using the Log Analytics agent for Linux agent. Security Center continuously adds new analytics that use Linux signals to detect malicious behaviors on cloud and on-premises Linux machines. Similar to Windows capabilities, these analytics span across suspicious processes, dubious sign-in attempts, kernel module loading, and other activities.

You can see these numbers of alerts can be generated and tracked by ASC for linux : https://learn.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-linux
Once generated, you will find them here under your ASC section :

For more information about process and alerts on linux, check our github simulation for linux detection : https://github.com/Azure/Azure-Security-Center/blob/main/Simulations/Azure%20Security%20Center%20Linux%20Detections_v2.pdf

Answer 2

hi vipul, i can see that the defender is enabled on all the vms including linux through security center but doesnt show any extension for atp or defender on the linux vms. the next option is to verify through command or query if the atp or qualys extension is present on the linux servers. defender is integrated through security center but what is the possible ways to find out if the defender is present on the linux servers. Thanks.