Microsoft Defender for IoT
General

Install Defender for IoT Micro Agent for Microsoft Edge

In brief

The article now has clearer installation wording, reordered repository setup commands, and updated guidance that the baseline validation failure recommendation may take up to one hour to appear in IoT Hub.

What Defender admins need to know

Administrators have clearer steps for installing and validating the agent on Debian and Ubuntu-based Linux systems.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

Install Defender for IoT micro agent for Edge

This article explains how to install,install and authenticateset up the Defender micro agent for Edge. The micro agent runs as a module on Azure IoT Edge devicesdevices. It monitors security threats and provides security monitoring, threat detection, and security posture management forhelps manage your IoT deployment. The steps in this article cover setting upsecurity posture. Before you begin, make sure you complete the prerequisites. You'll learn how to add the required package repositories, installingsources, install the agent package on Debian and Ubuntu-based Linux distributions,systems, and validating the installation.check that it works.

[!INCLUDE device-agents-note]

Prerequisites

Before you install the Defender micro agent for Edge, complete the following prerequisites:

  1. Navigate to your IoT Hub or, create a new IoT hub.

  2. Register an IoT Edge device in IoT Hub and retrieve the device connection strings.

  3. Add the appropriate Microsoft package repository.

    1. Download the repository configuration that matches your device operating system.

      • For Ubuntu 18.0404:

        curl https://packages.microsoft.com/config/ubuntu/18.04/multiarch/prod.list > ./microsoft-prod.list
        
      • For Ubuntu 20.04

        curl https://packages.microsoft.com/config/ubuntu/20.04/prod.list > ./microsoft-prod.list
        
      • For Debian 9 (both AMD64 and ARM64)

        curl https://packages.microsoft.com/config/debian/stretch/multiarch/prod.list > ./microsoft-prod.list
        
    2. Copy the repository configuration to the sources.list.d directory.

      sudo cp ./microsoft-prod.list /etc/apt/sources.list.d/
      
    3. Update the list of packages from the repository that you added with the following command:

      sudo apt-get update
      
  4. Install and configure Edge runtime version 1.2

Install the Defender for IoT micro agent for Edge

Perform the following steps to install and validate the Defender for IoT micro agent on supported Linux distributions.

  1. Install the Defender micro agent packagepackage. Run the following command on Debian, and Ubuntu Debian or Ubuntu-based Linux distributions, using the following command:systems:

    sudo apt-get install defender-iot-micro-agent-edge
    
  2. Validate your installation.

    1. Ensure the micro agent is running properly with the following command:

      systemctl status defender-iot-micro-agent.service
      
    2. Ensure that the service is stable by making sure it's active and that the uptime of the process is appropriate

      :::image type="content" source="media/quickstart-standalone-agent-binary-installation/active-running.png" alt-text="Check to make sure your service is stable and active.":::

  3. Test the system end-to-end by creating a trigger file on the device. The trigger file causes a baseline scan in the agent that detects the file as a baseline violation.

    Create a file on the file system with the following command:

    sudo touch /tmp/DefenderForIoTOSBaselineTrigger.txt
    

    A baseline validation failure recommendation occurs in the hub, with a CceId of CIS-debian-9-DEFENDER_FOR_IOT_TEST_CHECKS-0.0:

    :::image type="content" source="media/quickstart-standalone-agent-binary-installation/validation-failure.png" alt-text="The baseline validation failure recommendation that occurs in the hub." lightbox="media/quickstart-standalone-agent-binary-installation/validation-failure-expanded.png":::

    Allow up to one hour for the baseline validation failure recommendation to appear in your IoT Hub.

  4. Install a specific version of the Defender IoT micro agent, use the following command:

    sudo apt-get install defender-iot-micro-agent-edge=<version>
    

Next stepsstep

After you install and validate the micro agent, configure your agent-based solution:

[!div class="nextstepaction"] Configure Microsoft Defender for IoT agent-based solution