Release Notes Mde Archive

Oct-2020 (Build: 101.19.21)

What's new

• Product improvements

Oct-2020 (Build: 101.15.26)

What's new

• Improved the reliability of the agent when running on macOS 11 Big Sur.
• Added a new command-line switch (--ignore-exclusions) to ignore AV exclusions during custom scans (mdatp scan custom).

Sep-2020 (Build: 101.13.75)

What's new

• Removed conditions when Microsoft Defender for Endpoint was triggering a macOS 11 (Big Sur) issue that manifests into a kernel panic.
• Fixed a memory leak in the Endpoint Security system extension when running on macOS 11 (Big Sur).
• Product improvements

Aug-2020 (Build: 101.10.72)

What's new

• Product improvements

Jul-2020 (Build: 101.09.61)

What's new

• Added a new managed preference for disabling the option to send feedback.
• Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator.

Jul-2020 (Build: 101.09.50)

What's new

• This product version is validated on macOS Big Sur 11 preview 9.
• The new syntax for the mdatp command-line tool is now the default one. For more information on the new syntax, see Resources for Microsoft Defender for Endpoint on macOS.

• Extended mdatp diagnostic create with a new parameter (--path [directory]) that allows the diagnostic logs to be saved to a different directory.
• Performance improvements & Product improvements

Jul-2020 (Build: 101.09.49)

What's new

• User interface improvements to differentiate exclusions that are managed by the IT administrator versus exclusions defined by the local user.
• Improved CPU utilization during on-demand scans.

Jun-2020 (Build: 101.07.23)

What's new

• Added new fields to the output of mdatp --health for checking the status of passive mode and the EDR group ID.

May-2020 (Build: 101.06.63)

What's new

• Addressed a performance regression introduced in version 101.05.17. The regression was introduced with the fix to eliminate the kernel panics some customers observed when accessing SMB shares. We reverted this code change and are investigating alternative ways to eliminate the kernel panics.

May-2020 (Build: 101.05.17)

What's new

• Addressed a kernel panic that occurred sometimes when accessing SMB file shares.
• Performance improvements & Product improvements

Apr-2020 (Build: 101.05.16)

What's new

• Improvements to quick scan logic to significantly reduce the number of scanned files.
• Added autocompletion support for the command-line tool.

Mar-2020 (Build: 101.03.12)

What's new

• Performance improvements & Product improvements

Feb-2020 (Build: 101.01.54)

What's new

• Improvements around compatibility with Time Machine
• Accessibility improvements

Jan-2020 (Build: 101.00.31)

What's new

• Improved product onboarding experience for Intune users
• Antivirus exclusions now support wildcards

2019 releases (Build: 100.90.27)

What's new

• You can now set an update channel for Microsoft Defender for Endpoint on macOS that is different from the system-wide update channel.
• New product icon

2019 releases (Build: 100.86.92)

What's new

• Improvements around compatibility with Time Machine
• Addressed an issue where the product was sometimes not cleaning all files under /Library/Application Support/Microsoft/Defender during uninstallation.

2019 releases (Build: 100.86.91)

What's new

2019 releases (Build: 100.83.73)

What's new

• Added more controls for IT administrators around management of exclusions, management of threat type settings, and disallowed threat actions.
• When Full Disk Access isn't enabled on the device, a warning is now displayed in the status menu.

2019 releases (Build: 100.82.60)

What's new

• Addressed an issue where the product fails to start following a definition update.

2019 releases (Build: 100.80.42)

What's new

• Product improvements

2019 releases (Build: 100.79.42)

What's new

• Fixed an issue where Microsoft Defender for Endpoint on macOS was sometimes interfering with Time Machine.
• Added a new switch to the command-line utility for testing the connectivity with the backend service

2019 releases (Build: 100.72.15)

What's new

• Product improvements

2019 releases (Build: 100.70.99)

What's new

• Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender for Endpoint locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence.

2019 releases (Build: 100.68.99)

What's new

• Added the ability to configure the antivirus functionality to run in passive mode.
• Performance improvements & Product improvements

2019 releases (Build: 100.65.28)

What's new

• Added support for macOS Catalina.

July-2025 Build: 101.25052.0007 | Release version: 30.125052.0007.0

What's new

• Fixed issue to generate unique Machine identifiers to ensure each onboarded device is uniquely identified.
• Other stability improvements and bug fixes.

June-2025 Build: 101.25042.0003 | Release version: 30.125042.0003.0

What's new

• The Defender for Endpoint package rollout into production happens gradually. From the time the release notes are published, it might take up to a week for the package to be pushed to all production machines.
• Removed external dependency of uuid-runtime from the Defender for Endpoint package
• Other stability improvements and bug fixes

May-2025 Build: 101.25032.0010 | Release version: 30.125032.0010.0

What's new

• Removed external dependency of MDE Netfilter and libpcre from MDE package

• Fix for Python script executing unverified binaries with root-level privileges to identify Java processes using outdated versions of log4j (CVE-2025-26684) has been addressed.

• Added detection mechanism for CVE-2025-31324 affecting the "Visual Composer" component of the SAP NetWeaver application server.

April-2025 Build: 101.25022.0002 | Release version: 30.125022.0001.0

What's new

• mdatp diagnostic ebpf-statistics command requires sudo privilege now

• Manage dynamic signature file share source by setting URL and update interval

• Other stability improvements and bug fixes

• Support for ARM64 Linux servers

Mar-2025 Build: 101.25012.0000 | Release version: 30.125012.0000.0

What's new

• The MDATP package rollout into production will be done gradually. From the time the release notes are published, it might take up to a week for the package to be pushed to all production machines.

• The vulnerability in curl, CVE-2024-7264, has been addressed.

• Other stability improvements and bug fixes.

Known Issues

• There's a known issue where MDE is deleting the configuration file located at /etc/systemd/system/mdatp.service.d on each service start. As a workaround, customers can use the Immutable attribute that prevents the files from being modified or deleted.

  To set the file to be unmodifiable, execute the following command:

sudo chattr +i /etc/systemd/system/mdatp.service.d/[file name]

This command makes the file unchangeable. If you need to restore modification permissions, use the following command:

sudo chattr -i /etc/systemd/system/mdatp.service.d/[file name]

Note that the chattr command can only be used on supported file systems, such as ext4.

If you need further assistance, you can reach out to our support team with your organization ID, and we can implement a temporary mitigation to prevent deletion. A permanent fix for this issue is available in MDE version 101.25032.0000.

Feb-2025 Build: 101.24122.0008 | Release version: 30.124112.0008.0

What's new

Feb-2025 Build: 101.24112.0003 | Release version: 30.124112.0003.0

What's new

Jan-2025 Build: 101.24112.0001 | Release version: 30.124112.0001.0

What's new

• Upgraded the Bond version to 13.0.1 to address security vulnerabilities in versions 12 or lower.

• Mdatp package no longer has a dependency on SELinux packages.

• Users can now query the status of supplementary event provider eBPF using the threat hunting query in DeviceTvmInfoGathering. To learn more about this query check: Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux. The result of this query can return the following two values as eBPF status:

  • Enabled: When eBPF is enabled as working as expected.
  • Disabled: When eBPF is disabled due to one of the following reasons:

Jan-2025 Build: 101.24102.0000 | Release version: 30.124102.0000.0

What's new

Nov-2024 Build: 101.24092.0002 | Release version: 30.124092.0002.0

What's new

Oct-2024 Build: 101.24082.0004 | Release version: 30.124082.0004.0

What's new

• Starting with this version, Defender for Endpoint on Linux no longer supports AuditD as a supplementary event provider. For improved stability and performance, we have transitioned to eBPF. If you disable eBPF, or in the event eBPF isn't supported on any specific kernel, Defender for Endpoint on Linux automatically switches back to Net link as a fallback supplementary event provider. Net link provides reduced functionality and tracks only process-related events. In this case, all process operations continue to flow seamlessly, but you could miss specific file and socket-related events that eBPF would otherwise capture. For more information, see Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux. If you have any concerns or need assistance during this transition, contact support.

• Stability and performance improvements

• Other bug fixes

Sept-2024 Build: 101.24072.0001 | Release version: 30.124072.0001.0

What's new

July-2024 Build: 101.24062.0001 | Release version: 30.124062.0001.0

What's new

There are multiple fixes and new changes in this release.

• Fixes bug in which infected command-line threat information wasn't showing correctly in security portal.

• Fixes a bug where disabling a preview feature required a Defender of Endpoint to disable it.

• Global Exclusions feature using managed JSON is now in Public Preview. available in insiders slow from 101.23092.0012. For more information, see linux-exclusions.

• Updated the Linux default engine version to 1.1.24050.7 and default signature version to 1.411.410.0.

• Stability and performance improvements.

• Other bug fixes.

June-2024 Build: 101.24052.0002 | Release version: 30.124052.0002.0

What's new

• This release fixes a bug related to high memory usage eventually leading to high CPU due to eBPF memory leak in kernel space resulting in servers going into unusable states. This only affected the kernel versions 3.10x and <= 4.16x, majorly on RHEL/CentOS distros. Update to the latest MDE version to avoid any impact.

• We have now simplified the output of mdatp health --detail features

• Stability and performance improvements.

• Other bug fixes.

May-2024 Build: 101.24042.0002 | Release version: 30.124042.0002.0

What's new

There are multiple fixes and new changes in this release:

• In version 24032.0007, there was a known issue where the enrollment of devices to MDE Security Management failed when using the "Device Tagging" mechanism via the mdatp_managed.json file. This issue has been resolved in the current release.

• Stability and performance improvements.

• Other bug fixes.

May-2024 Build: 101.24032.0007 | Release version: 30.124032.0007.0

What's new

There are multiple fixes and new changes in this release:

• In passive and on-demand modes, antivirus engine remains in idle state and is used only during scheduled custom scans. Thus as part of performance improvements, we have made changes to keep the AV engine down in passive and on-demand mode except during scheduled custom scans. If the real time protection is enabled, antivirus engine will always be up and running. This has no impact on your server protection in any mode.

  To keep users informed of the state of antivirus engine, we have introduced a new field called "engine_load_status" as part of MDATP health. It indicates whether antivirus engine is currently running or not.

  Field name	engine_load_status
  Possible values	Engine not loaded (AV engine process is down), Engine load succeeded (AV engine process up and running)

  Healthy scenarios:

  • If RTP is enabled, engine_load_status should be "Engine load succeeded"
  • If MDE is in on-demand or passive mode, and custom scan isn't running then "engine_load_status" should be "Engine not loaded"
  • If MDE is in on-demand or passive mode, and custom scan is running then "engine_load_status" should be "Engine load succeeded"

• Bug fix to enhance behavioral detections.

• Stability and performance improvements.

• Other bug fixes.

Known Issues

sudo mdatp edr tag set --name GROUP --value MDE-Management

**
The issue has been fixed in Build: 101.24042.0002**

March-2024 Build: 101.24022.0001 | Release version: 30.124022.0001.0

What's new

There are multiple fixes and new changes in this release:

• The addition of a new log file - microsoft_defender_scan_skip.log. This logs the filenames that were skipped from various antivirus scans by Microsoft Defender for Endpoint due to any reason.

• Stability and performance improvements.

• Bug fixes.

March-2024 Build: 101.24012.0001 | Release version: 30.124012.0001.0

What's new

There are multiple fixes and new changes in this release:

• Updated default engine version to 1.1.23110.4, and default signatures version to 1.403.87.0.

• Stability and performance improvements.

• Bug fixes.

February-2024 Build: 101.23122.0002 | Release version: 30.123122.0002.0

What's new

There are multiple fixes and new changes in this release:

• Updated default engine version to 1.1.23100.2010, and default signatures version to 1.399.1389.0.

• General stability and performance improvements.

• Bug fixes.

• Microsoft Defender for Endpoint on Linux now officially supports the following distros and versions:

  Distro & version	Ring	Package
  Mariner 2	Production	https://packages.microsoft.com/cbl-mariner/2.0/prod/extras/x86_64/config.repo
  Rocky 8.7 and higher	Insiders Slow	https://packages.microsoft.com/config/rocky/8/insiders-slow.repo
  Rocky 9.2 and higher	Insiders Slow	https://packages.microsoft.com/config/rocky/9/insiders-slow.repo
  Alma 8.4 and higher	Insiders Slow	https://packages.microsoft.com/config/alma/8/insiders-slow.repo
  Alma 9.2 and higher	Insiders Slow	https://packages.microsoft.com/config/alma/9/insiders-slow.repo

If you already have Defender for Endpoint running on any of these distros and facing any issues in the older versions, upgrade to the latest Defender for Endpoint version from the corresponding ring mentioned above.

January-2024 Build: 101.23112.0009 | Release version: 30.123112.0009.0

What's new

November-2023 Build: 101.23102.0003 | Release version: 30.123102.0003.0

What's new

November-2023 Build: 101.23092.0012 | Release version: 30.123092.0012.0

What's new

There are multiple fixes and new changes in this release:

• Support added to restore threat based on original path using the following command:

  sudo mdatp threat quarantine restore threat-path --path [threat-original-path] --destination-path [destination-folder]
  

• From this release, Microsoft Defender for Endpoint on Linux will no longer be shipping a solution for RHEL 6.

  RHEL 6 'Extended end of life support' is poised to end by June 30, 2024 and customers are advised to plan their RHEL upgrades accordingly aligned with guidance from Red Hat. Customers who need to run Defender for Endpoint on RHEL 6 servers can continue to use version 101.23082.0011 (doesn't expire before June 30, 2024) supported on kernel versions 2.6.32-754.49.1.el6.x86_64 or prior.

  • Engine Update to 1.1.23080.2007 and Signatures Ver: 1.395.1560.0.
  • Streamlined device connectivity experience is now in public preview mode. public blog

    Known issues:

    Microsoft Defender for Endpoint for Linux on Rocky and Alma currently has the following known issues:

    • Live Response and Threat Vulnerability Management are currently not supported (work in progress).
    • Operating system info for devices isn't visible in the Microsoft Defender portal

    January-2024 Build: 101.23112.0009 | Release version: 30.123112.0009.0

    Build:	101.23112.0009
    Released:	January 29,2024
    Published:	January 29,2024
    Release version:	30.123112.0009.0
    Engine version:	1.1.23100.2010
    Signature version:	1.399.1389.0

    What's new

    November-2023 Build: 101.23102.0003 | Release version: 30.123102.0003.0

    Build:	101.23102.0003
    Released:	November 28,2023
    Published:	November 28,2023
    Release version:	30.123102.0003.0
    Engine version:	1.1.23090.2008
    Signature version:	1.399.690.0

    What's new

    November-2023 Build: 101.23092.0012 | Release version: 30.123092.0012.0

    Build:	101.23092.0012
    Released:	November 14,2023
    Published:	November 14,2023
    Release version:	30.123092.0012.0
    Engine version:	1.1.23080.2007
    Signature version:	1.395.1560.0

    What's new

    There are multiple fixes and new changes in this release:

    • Support added to restore threat based on original path using the following command:

      sudo mdatp threat quarantine restore threat-path --path [threat-original-path] --destination-path [destination-folder]
      

    • From this release, Microsoft Defender for Endpoint on Linux will no longer be shipping a solution for RHEL 6.

      RHEL 6 'Extended end of life support' is poised to end by June 30, 2024 and customers are advised to plan their RHEL upgrades accordingly aligned with guidance from Red Hat. Customers who need to run Defender for Endpoint on RHEL 6 servers can continue to use version 101.23082.0011 (doesn't expire before June 30, 2024) supported on kernel versions 2.6.32-754.49.1.el6.x86_64 or prior.

    • Engine Update to 1.1.23080.2007 and Signatures Ver: 1.395.1560.0.

    • Streamlined device connectivity experience is now in public preview mode. public blog

    • Performance improvements & bug fixes.

  Known issues

  November-2023 Build: 101.23082.0011 | Release version: 30.123082.0011.0

  Build:	101.23082.0011
  Released:	November 1,2023
  Published:	November 1,2023
  Release version:	30.123082.0011.0
  Engine version:	1.1.23070.1002
  Signature version:	1.393.1305.0

  What's new

  • This new release is built over October 2023 release (101.23082.0009) with addition of following changes. There's no change for other customers and upgrading is optional.

  • Fix for immutable mode of auditd when supplementary subsystem is ebpf: In ebpf mode all mdatp audit rules should be cleaned after switching to ebpf and rebooting. After the reboot, mdatp audit rules weren't cleaned due to which it was resulting in hang of the server. The fix cleans these rules, user shouldn't see any mdatp rules loaded on reboot

  • Fix for MDE not starting up on RHEL 6.

  Known issues

  sudo apt purge mdatp
  
  sudo apt-get install mdatp
  

  2. As an alternative you can follow the instructions to uninstall, then install the latest version of the package.

  If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading. Some customers (<1%) experience issues with this method.

  sudo mdatp config real-time-protection --value=disabled
  
  sudo systemctl disable mdatp
  

  October-2023 Build: 101.23082.0009 | Release version: 30.123082.0009.0

  Build:	101.23082.0009
  Released:	October 9,2023
  Published:	October 9,2023
  Release version:	30.123082.0009.0
  Engine version:	1.1.23070.1002
  Signature version:	1.393.1305.0

  What's new

  • This new release is built over October 2023 release (101.23082.0009) with addition of new CA Certificates. There's no change for other customers and upgrading is optional.

  Known issues

  October-2023 Build: 101.23082.0006 | Release version: 30.123082.0006.0

  Build:	101.23082.0006
  Released:	October 9,2023
  Published:	October 9,2023
  Release version:	30.123082.0006.0
  Engine version:	1.1.23070.1002
  Signature version:	1.393.1305.0

  What's new

  • Feature updates and new changes

    • eBPF sensor is now the default supplementary event provider for endpoints

    • Microsoft Intune tenant attach feature is in public preview (as of mid July)

      • You must add "*.dm.microsoft.com" to firewall exclusions for the feature to work correctly

    • Defender for Endpoint is now available for Debian 12 and Amazon Linux 2023

    • Support to enable Signature verification of updates downloaded

      • You must update the manajed.json as shown:

          "features":{
            "OfflineDefinitionUpdateVerifySig":"enabled"
          }
        

      • Prerequisite to enable feature

        • Engine version on the device must be "1.1.23080.007" or above. Check your engine version by using the following command.

          mdatp health --field engine_version

    • Option to support monitoring of NFS and FUSE mount points. These are ignored by default. The following example shows how to monitor all filesystem while ignoring only NFS:

      "antivirusEngine": {
          "unmonitoredFilesystems": ["nfs"]
      }
    

    Example to monitor all filesystems including NFS and FUSE:

    "antivirusEngine": {
       "unmonitoredFilesystems": []
    }
    

    • Other performance improvements

    • Bug Fixes

  Known issues

  sudo apt purge mdatp
  
  sudo apt-get install mdatp
  

  September-2023 Build: 101.23072.0021 | Release version: 30.123072.0021.0

  Build:	101.23072.0021
  Released:	September 11,2023
  Published:	September 11,2023
  Release version:	30.123072.0021.0
  Engine version:	1.1.20100.7
  Signature version:	1.385.1648.0

  What's new

  There are multiple fixes and new changes in this release:

  • In mde_installer.sh v0.6.3, users can use the --channel argument to provide the channel of the configured repository during cleanup. For example, sudo ./mde_installer --clean --channel prod

  • The Network Extension can now be reset by administrators using mdatp network-protection reset.

  • Other performance improvements

  • Bug Fixes

  Known issues

  sudo apt purge mdatp
  
  sudo apt-get install mdatp
  

  sudo mdatp config real-time-protection --value=disabled
  
  sudo systemctl disable mdatp
  

  July-2023 Build: 101.23062.0010 | Release version: 30.123062.0010.0

  Build:	101.23062.0010
  Released:	July 26,2023
  Published:	July 26,2023
  Release version:	30.123062.0010.0
  Engine version:	1.1.20100.7
  Signature version:	1.385.1648.0

  What's new

  There are multiple fixes and new changes in this releaserelease:

  • If a proxy is set for Defender for Endpoint, then it's visible in the mdatp health command output. With this release we provided two options in mdatp diagnostic hot-event-sources:

    • Files
    • Executables

  • Network Protection: Connections that are blocked by Network Protection and have the block overridden by users is now correctly reported to Microsoft Defender XDR

  • Improved logging in Network Protection block and audit events for debugging

  • Other fixes and improvements

    • From this version, enforcementLevel are in passive mode by default giving admins more control over where they want 'RTP on' within their estate
    • This change only applies to fresh MDE deployments, for example, servers where Defender for Endpoint is being deployed for the first time. In update scenarios, servers that have Defender for Endpoint deployed with RTP ON, continue operating with RTP ON even post update to version 101.23062.0010

  • Bug fix: RPM database corruption issue in Defender Vulnerability Management baseline is fixed.

  • Other performance improvements

  Known issues

  sudo apt purge mdatp
  
  sudo apt-get install mdatp
  

  sudo mdatp config real-time-protection --value=disabled
  
  sudo systemctl disable mdatp
  

  July-2023 Build: 101.23052.0009 | Release version: 30.123052.0009.0

  Build:	101.23052.0009
  Released:	July 10,2023
  Published:	July 10,2023
  Release version:	30.123052.0009.0
  Engine version:	1.1.20100.7
  Signature version:	1.385.1648.0

  What's new

  • There are multiple fixes and new changes in this release - release:

    • The build version schema is updated from this release. While the major version number remains same as 101, the minor version number now has five digits followed by four digit patch number that is, 101.xxxxx.yyy -
    • Improved Network Protection memory consumption under stress
      • Updated the engine version to 1.1.20300.5 and signature version to 1.391.2837.0.
      • Bug fixes.

    Known issues

    sudo apt purge mdatp
    
    sudo apt-get install mdatp
    

    sudo mdatp config real-time-protection --value=disabled
    
    sudo systemctl disable mdatp
    

    June-2023 Build: 101.98.89 | Release version: 30.123042.19889.0

    Build:	101.98.89
    Released:	June 12,2023
    Published:	June 12,2023
    Release version:	30.123042.19889.0
    Engine version:	1.1.20100.7
    Signature version:	1.385.1648.0

    What's new

    There are multiple fixes and new changes in this release release:

    • Improved Network Protection Proxy handling.

    • In Passive mode, Defender for Endpoint no longer scans when Definition update happens.

    • Devices continue to be protected even after Defender for Endpoint agent is expired. We recommend upgrading the Defender for Endpoint Linux agent to the latest available version to receive bug fixes, features, and performance improvements.

    • Removed semanage package dependency.

    • Engine Update to 1.1.20100.7 and Signatures Ver: 1.385.1648.0.

    • Bug fixes.

    Known issues

    2. As an alternative you can follow the instructions to uninstall, then install the latest version of the package.

    If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading. Some customers (<1%) experience issues with this method.

    sudo mdatp config real-time-protection --value=disabled
    
    ### May-2023 Build: 101.98.64 | Release version: 30.123032.19864.0
    
    |Build:| Build:             | ****101.98.64**|
    |--------------------|-----------------------|
    |Released:| Released:          | ****May 3,2023**|
    |Published:| Published:         | ****May 3,2023**|
    |Release version:| Release version:   | ****30.123032.19864.0**|
    |Engine version:| Engine version:    | ****1.1.20100.6**|
    |Signature version:| Signature version: | ****1.385.68.0**|
    
    #### What's new
    
    There are multiple fixes and new changes in this releaserelease:
    
    - Health message improvements to capture details about auditd failures.
    - Improvements to handle augenrules, which was causing installation failure.
    - Periodic memory cleanup in engine process.
    - Fix for memory issue in mdatp audisp plugin.
    - Handled missing plugin directory path during installation.
    - When conflicting application is using blocking fanotify, with default configuration mdatp health shows unhealthy. This is now fixed.
    - Support for ICMP traffic inspection in BM.
    - Engine Update to `1.1.20100.6` and Signatures Ver: `1.385.68.0`.
    - Bug fixes.
    
    #### Known issues
    
    2. As an alternative you can follow the instructions to [uninstall](./linux-off-board-endpoints.md#uninstall-the-defender-application-from-a-linux-server), then [install](linux-install-manually.md#application-installation) the latest version of the package.
    
    If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading.
    Caution: Some customers (<1%) experience issues with this method.
    
    ```bash
    sudo mdatp config real-time-protection --value=disabled
    
    ### April-2023 Build: 101.98.58 | Release version: 30.123022.19858.0
    
    |Build:| Build:             | ****101.98.58**|
    |--------------------|-----------------------|
    |Released:| Released:          | ****April 20,2023**|
    |Published:| Published:         | ****April 20,2023**|
    |Release version:| Release version:   | ****30.123022.19858.0**|
    |Engine version:| Engine version:    | ****1.1.20000.2**|
    |Signature version:| Signature version: | ****1.381.3067.0**|
    
    #### What's new
    
    There are multiple fixes and new changes in this releaserelease:
    
    - Logging and error reporting improvements for auditd.
    - Handle failure in reload of auditd configuration.
    - Handling for empty auditd rule files during MDE install.
    - Engine Update to `1.1.20000.2` and Signatures Ver: `1.381.3067.0`.
    - Addressed a health issue in mdatp that occurs due to selinux denials.
    - Bug fixes.
    
    #### Known issues
    
      ```bash
      echo -c >> /etc/audit/rules.d/audit.rules
    
      augenrules --load
    

    There are two ways to mitigate this upgrade issue:

    1. Use your package manager to uninstall the 101.75.43 or 101.78.13 mdatp version.

       Example:

       sudo apt purge mdatp
       
       sudo apt-get install mdatp
       

    2. As an alternative you can follow the instructions to uninstall, then install the latest version of the package.

    If you don't want to uninstall mdatp, you can disable rtp and mdatp in sequence before upgrading. Caution: Some customers (<1%) experience issues with this method.

    sudo mdatp config real-time-protection --value=disabled
    
    sudo systemctl disable mdatp
    

    March-2023 Build: 101.98.30 | Release version: 30.123012.19830.0

    Build:	101.98.30
    Released:	March 20, 2023
    Published:	March 20, 2023
    Release version:	30.123012.19830.0
    Engine version:	1.1.19900.2
    Signature version:	1.379.1299.0

    What's new

    • This new release is built over March 2023 release (101.98.05) with a fix for Live response commands failing for one of our customers. There's no change for other customers and upgrade is optional.

    Known issues

    • With mdatp version 101.98.30 you might see a health false issue in some of the cases, because SELinux rules aren't defined for certain scenarios. The health warning could look something like this:

    sudo ausearch -c 'mdatp_audisp_pl' --raw | sudo audit2allow -M my-mdatpaudisppl_v1
    
    sudo semodule -i my-mdatpaudisppl_v1.pp
    

    sudo service auditd stop
    
    sudo systemctl stop mdatp
    
    cd /var/log/audit
    
    sudo gzip audit.*
    
    sudo service auditd start
    
    sudo systemctl start mdatp
    
    mdatp health
    

    March-2023 Build: 101.98.05 | Release version: 30.123012.19805.0

    Build:	101.98.05
    Released:	March 08, 2023
    Published:	March 08, 2023
    Release version:	30.123012.19805.0
    Engine version:	1.1.19900.2
    Signature version:	1.379.1299.0

    What's new

    • Improved Data Completeness for Network Connection events

    • Improved Data Collection capabilities for file ownership/permissions changes

    • seManage in part of the package, to that seLinux policies can be configured in different distro (fixed).

    • Improved enterprise daemon stability

    • AuditD stop path clean-up

    • Improved the stability of mdatp stop flow.

    • Added new field to wdavstate to keep track of platform update time.

    • Stability improvements to parsing Defender for Endpoint onboarding blob.

    • Scan doesn't proceed if a valid license isn't present (fixed)

    • Added performance tracing option to xPlatClientAnalyzer, with tracing enabled mdatp process dumps the flow in all_process.zip file that can be used for analysis of performance issues.

    • Added support in Defender for Endpoint for the following RHEL-6 kernel versions:

      • 2.6.32-754.43.1.el6.x86_64
      • 2.6.32-754.49.1.el6.x86_64

    • Other fixes

    Known issues

    While upgrading mdatp to version 101.94.13, you might notice that health is false, with health_issues as "no active supplementary event provider". This can happen due to misconfigured/conflicting auditd rules on existing machines. To mitigate the issue, the auditd rules on the existing machines need to be fixed. The following steps can help you to identify such auditd rules (these commands need to be run as super user). Make sure to back up following file: /etc/audit/rules.d/audit.rules as these steps are only to identify failures.

    echo -c >> /etc/audit/rules.d/audit.rules
    
    augenrules --load
    

    sudo apt purge mdatp
    
    sudo apt-get install mdatp
    

    As an alternative, you can follow the instructions to uninstall, then install the latest version of the package.

    In case you don't want to uninstall mdatp you can disable rtp and mdatp in sequence before upgrade. Caution: Some customers(<1%) are experiencing issues with this method.

    sudo mdatp config real-time-protection --value=disabled
    
    ### Jan-2023 Build: 101.94.13 | Release version: 30.122112.19413.0
    
    |Build:| Build:             | ****101.94.13**|
    |--------------------|-----------------------|
    |Released:| Released:          | ****January 10, 2023**|
    |Published:| Published:         | ****January 10, 2023**|
    |Release version:| Release version:   | ****30.122112.19413.0**|
    |Engine version:| Engine version:    | ****1.1.19700.3**|
    |Signature version:| Signature version: | ****1.377.550.0**|
    
    #### What's new
    
    -
    
    There are multiple fixes and new changes in this releaserelease:
    
    - Skip quarantine of threats in passive mode by default.
    - New config, nonExecMountPolicy, can now be used to specify behavior of RTP on mount point marked as noexec.
    - New config, unmonitoredFilesystems, can be used to unmonitor certain filesystems.
    - Improved performance under high load and in speed test scenarios.
    - Fixes an issue with accessing SMB shares behind Cisco AnyConnect VPN connections.
    - Fixes an issue with Network Protection and SMB.
    - lttng performance tracing support.
    - TVM, eBPF, auditd, telemetry, and mdatp cli improvements.
    - mdatp health now reports behavior_monitoring
    - Other fixes.
    
    #### Known issues
    
    
    ```bash
    sudo apt purge mdatp
    
    sudo apt-get install mdatp
    

    sudo mdatp config real-time-protection --value=disabled
    
    sudo systemctl disable mdatp
    

    Nov-2022 Build: 101.85.27 | Release version: 30.122092.18527.0

    Build:	101.85.27
    Released:	November 02, 2022
    Published:	November 02, 2022
    Release version:	30.122092.18527.0
    Engine version:	1.1.19500.2
    Signature version:	1.371.1369.0

    What's new

    • There are multiple fixes and new changes in this releaserelease:

      • V2 engine is default with this release and V1 engine bits are removed for enhanced security.
      • V2 engine support configuration path for AV definitions. (mdatp definition set path)
      • Removed external packages dependencies from MDE package. Removed dependencies are libatomic1, libselinux, libseccomp, libfuse, and libuuid
      • In case crash collection is disabled by configuration, crash monitoring process isn't launched.
      • Performance fixes to optimally use system events for AV capabilities.
      • Stability improvement when restarting mdatp and load epsext issues.
      • Other fixes

    Known issues

    sudo apt purge mdatp
    
    sudo apt-get install mdatp
    

    sudo mdatp config real-time-protection --value=disabled
    
    sudo systemctl disable mdatp
    

    Sep-2022 Build: 101.80.97 | Release version: 30.122072.18097.0

    Build:	101.80.97
    Released:	September 14, 2022
    Published:	September 14, 2022
    Release version:	30.122072.18097.0
    Engine version:	1.1.19300.3
    Signature version:	1.369.395.0

    What's new

    sudo mdatp config real-time-protection --value=disabled
    
    sudo systemctl disable mdatp
    

    Aug-2022 Build: 101.78.13 | Release version: 30.122072.17813.0

    Build:	101.78.13
    Released:	August 24, 2022
    Published:	August 24, 2022
    Release version:	30.122072.17813.0
    Engine version:	1.1.19300.3
    Signature version:	1.369.395.0

    What's new

    • Rolled back due to reliability issues

    Aug-2022 (Build: 101.75.43 | Release version: 30.122071.17543.0)

    Build:	101.75.43
    Released:	August 2, 2022
    Published:	August 2, 2022
    Release version:	30.122071.17543.0
    Engine version:	1.1.19300.3
    Signature version:	1.369.395.0

    What's new

    Jul-2022 Build: 101.73.77 | Release version: 30.122062.17377.0

    Build:	101.73.77
    Released:	July 21, 2022
    Published:	July 21, 2022
    Release version:	30.122062.17377.0
    Engine version:	1.1.19200.3
    Signature version:	1.367.1011.0

    What's new

    Jun-2022 Build: 101.71.18 | Release version: 30.122052.17118.0

    Build:	101.71.18
    Released:	June 24, 2022
    Published:	June 24, 2022
    Release version:	30.122052.17118.0

    What's new

    May-2022 Build: 101.68.80 | Release version: 30.122042.16880.0

    Build:	101.68.80
    Released:	May 23, 2022
    Published:	May 23, 2022
    Release version:	30.122042.16880.0

    What's new

    May-2022 Build: 101.65.77 | Release version: 30.122032.16577.0

    Build:	101.65.77
    Released:	May 2, 2022
    Published:	May 2, 2022
    Release version:	30.122032.16577.0

    What's new

    Mar-2022 (Build: 101.62.74 | Release version: 30.122022.16274.0)

    Build:	101.62.74
    Released:	Mar 24, 2022
    Published:	Mar 24, 2022
    Release version:	30.122022.16274.0

    What's new

    Mar-2022 Build: 101.60.93 | Release version: 30.122012.16093.0

    Build:	101.60.93
    Released:	Mar 9, 2022
    Published:	Mar 9, 2022
    Release version:	30.122012.16093.0

    What's new

    Mar-2022 Build: 101.60.05 | Release version: 30.122012.16005.0

    Build:	101.60.05
    Released:	Mar 3, 2022
    Published:	Mar 3, 2022
    Release version:	30.122012.16005.0

    What's new

    Feb-2022 Build: 101.58.80 | Release version: 30.122012.15880.0

    Build:	101.58.80
    Released:	Feb 20, 2022
    Published:	Feb 20, 2022
    Release version:	30.122012.15880.0

    What's new

    Jan-2022 Build: 101.56.62 | Release version: 30.121122.15662.0

    Build:	101.56.62
    Released:	Jan 26, 2022
    Published:	Jan 26, 2022
    Release version:	30.121122.15662.0

    What's new

    Jan-2022 Build: 101.53.02 | Release version: 30.121112.15302.0

    Build:	101.53.02
    Released:	Jan 8, 2022
    Published:	Jan 8, 2022
    Release version:	30.121112.15302.0

    What's new

    Build: 101.52.57 | Release version: 30.121092.15257.0

    Build:	101.52.57
    Release version:	30.121092.15257.0

    What's new

    • Added a capability to detect vulnerable Log4j jars in use by Java applications. The machine is periodically inspected for running Java processes with loaded Log4j jars. The information is reported to the Microsoft Defender for Endpoint backend and is exposed in the Vulnerability Management area of the portal.

    Build: 101.47.76 | Release version: 30.121092.14776.0

    Build:	101.47.76
    Release version:	30.121092.14776.0

    What's new

    • Added a new switch to the command-line tool to control whether archives are scanned during on-demand scans. This can be configured through mdatp config scan-archives--value [enabled/disabled]. By default, this setting is set to enabled.

    • Bug fixes

    Build: 101.45.13 | Release version: 30.121082.14513.0

    Build:	101.45.13
    Release version:	30.121082.14513.0

    What's new

    • Beginning with this version, we're bringing Microsoft Defender for Endpoint support to the following distros:

      • RHEL6.7-6.10 and CentOS6.7-6.10 versions.
      • Amazon Linux 2
      • Fedora 33 or higher

    • Bug fixes

    Build: 101.45.00 | Release version: 30.121072.14500.0

    Build:	101.45.00
    Release version:	30.121072.14500.0

    What's new

    Build: 101.39.98 | Release version: 30.121062.13998.0

    Build:	101.39.98
    Release version:	30.121062.13998.0

    What's new

    Build: 101.34.27 | Release version: 30.121052.13427.0

    Build:	101.34.27
    Release version:	30.121052.13427.0

    What's new

    Build: 101.29.64 | Release version: 30.121042.12964.0

    Build:	101.29.64
    Release version:	30.121042.12964.0

    What's new

    Build: 101.25.72 | Release version: 30.121022.12563.0

    Build:	101.25.72
    Release version:	30.121022.12563.0

    What's new

    • Microsoft Defender for Endpoint on Linux is now available in preview for US Government customers. For more information, see Microsoft Defender for Endpoint for US Government customers.
    • Fixed an issue where usage of Microsoft Defender for Endpoint on Linux on systems with FUSE filesystems was leading to OS hang
    • Performance improvements & other bug fixes

    Build: 101.25.63 | Release version: 30.121022.12563.0

    Build:	101.25.63
    Release version:	30.121022.12563.0

    What's new

    Build: 101.23.64 | Release version: 30.121021.12364.0

    Build:	101.23.64
    Release version:	30.121021.12364.0

    What's new

    What's new

    • EDR for Linux is now generally available

    • Added a new command-line switch (--ignore-exclusions) to ignore AV exclusions during custom scans (mdatp scan custom)

    • Extended mdatp diagnostic create with a new parameter (--path [directory]) that allows the diagnostic logs to be saved to a different directory

    • Performance improvements & bug fixes

    1.1.15010101

    • With this version, we're announcing support for iPadOS/iPad devices.
    • Bug fixes. \ No newline at end of file
    • Bug fixes.