Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Identity protection

Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux

4 September 2026Doc update+11 / −10 lines

In brief

The article now clarifies how to enable or disable the eBPF supplementary event provider, verify AuditD rules after reboot, check kernel prerequisites, handle the RHEL 8.1 with SAP warning, and interpret eBPF statistics.

What Defender admins need to know

Administrators have clearer commands and validation steps; no action is required solely because of this update.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux

:::image type="content" source="/defender/media/defender-endpoint/ebpf-subsystem-linux.png" alt-text="ebpf subsystem highlight in the mdatp health command" lightbox="/defender/media/defender-endpoint/ebpf-subsystem-linux.png":::

In case you want to manuallyTo enable or disable the eBPF then you cansupplementary event provider, run the following command:

sudo mdatp config ebpf-supplementary-event-provider --value [enabled/disabled]

YouAlternatively, you can also updatedisable the eBPF supplementary event provider by setting ebpfSupplementaryEventProvider to disabled in the mdatp_managed.json file:

{

## Immutable mode of AuditD

For customers using AuditD in immutable mode, a reboot is required post enablement of eBPF in order to clear the audit rules added by Microsoft Defender for Endpoint. This requirement is a limitation in immutable mode of AuditD, which freezes the rules file and prohibits editing/overwriting. This issue is resolved withRebooting clears the reboot.

Post reboot, run the following command to check ifMicrosoft Defender for Endpoint audit rules that can't be removed while AuditD is in immutable mode.

After the reboot, list the current AuditD rules to confirm that the Defender for Endpoint audit rules were successfully cleared:

```bash
% sudo auditctl -l

### Troubleshooting and Diagnostics

You can check the agent health status by running the `mdatp` health command. Make sureTo verify that your kernel version meets the eBPF sensor for Defender for Endpoint on Linux is supported by checkingrequirements listed in [System prerequisites](#system-prerequisites), check the current kernel version by usingrunning the following command line:command:

```bash
uname -a

Be aware of the following known issues when using the eBPF sensor on Linux:

1. Enabling**Warning:** On RHEL 8.1 with SAP, enabling eBPF can cause a kernel panic. Before enabling eBPF on RHEL 8.1 version with SAP might result in kernel panic. To mitigate this issue, you canconfiguration, take one of the following mitigation steps:

   - Use a distro version higher than RHEL 8.1.
   - Switch to AuditD mode if you need to use RHEL 8.1 version.
sudo mdatp diagnostic  ebpf-statistics

The following sample output shows the eBPF statistics collected over a 20-second monitoring interval, including the top file paths, initiator processes, and system call IDs:

Output
Monitor 20 seconds
Top file paths:
/var/log/microsoft/mdatp/microsoft_defender.log : 10
87 : 3

In the previousmdatp diagnostic ebpf-statistics output, you can see that stress-ng is the top process generating a large number of events and might result intoin performance issues. Most likely stress-ng is generating the system call with ID 82. You can create a ticket with Microsoft to get this process excluded.

Exclusions applied to AuditD can't be migrated or copied to eBPF. Common concerns such as noisy logs, kernel panic, noisy syscalls are already taken care of by eBPF internally. In case you want to add any further exclusions, then reach out to Microsoft to get the necessary exclusions applied.