Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Run Analyzer Linux

5 November 2026Doc update+12 / −216 lines

In brief

The page removes the AuditD rate-limiter and faulty-rule options, along with detailed Live Response scripts for running or installing the Client Analyzer. It retains links to the binary and Python analyzer versions.

What Defender admins need to know

Administrators will find fewer troubleshooting commands and setup examples on this page; existing deployments require no stated action.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

sudo ./MDESupportTool exclude -d /var/foo/bar`

AuditD rate limiter

This option sets the rate limit globally for AuditD causing a drop in all the audit events. When the limiter is enabled, the auditd events are limited to 2500 events/sec. This option can be used in cases where we see high CPU usage from AuditD side.


-h, --help                                  show this help message and exit
-e <true/false>, --enable <true/false>      enable/disable the rate limit with default values

Usage example:

sudo ./mde_support_tool.sh ratelimit -e true

Note

This functionality should be carefully used as it limits the number of events the auditd subsystem reports as a whole. This could reduce the number of events for other subscribers as well.

AuditD skip faulty rules

This option enables you to skip the faulty rules added in the auditd rules file while loading them. It allows the auditd subsystem to continue loading rules even if there's a faulty rule.


-h, --help                                  show this help message and exit
-e <true/false>, --enable <true/false>      enable/disable the option to skip the faulty rules. In case no argumanet is passed, the option will be true by default.

Usage example:

sudo ./mde_support_tool.sh skipfaultyrules -e true

Note

This functionality skips the faulty rules. Faulty rules must be further identified and fixed.

Use live response in Defender for Endpoint to collect support logs

The XMDE Client Analyzer can be run during a Live Response session either by using the version that is already included with Microsoft Defender for Endpoint on Linux, or by downloading the Client Analyzer as a binary or Python package and extracting it on the device.

  • For installation, the unzip package is required.
  • For execution, the acl package is required.

Windows uses the carriage return and line feed invisible characters to represent the end of one line and beginning of a new line in a file. Linux systems use only the Line Feed invisible character at the end of file lines. When you use the following scripts, if done on Windows, this difference can result in errors and failures of the scripts to run. A potential solution to this is to utilize the Windows Subsystem for Linux (WSL) and the dos2unix package to reformat the script so it aligns with the Unix and Linux format standard.

Run Client Analyzer from the Microsoft Defender for Endpoint installation

If Microsoft Defender for Endpoint is already installed on the device, you can run the Client Analyzer directly from the agent installation without downloading or installing additional packages.

  • Create an MDESupportToolBinary.sh file and paste the following content into it.

    #! /usr/bin/bash

echo "cd /opt/microsoft/mdatp/tools/client_analyzer/binary"
cd /opt/microsoft/mdatp/tools/client_analyzer/binary

echo "Running MDESupportTool"
./MDESupportTool $@

Execute:
run MDESupportToolBinary.sh -parameters "--bypass-disclaimer -d"

MDESupportToolPython.sh

#! /usr/bin/bash

echo "cd /opt/microsoft/mdatp/tools/client_analyzer/python"
cd /opt/microsoft/mdatp/tools/client_analyzer/python

echo "Running MDESupportTool"
./mde_support_tool.sh $@

Execute:
run MDESupportToolPython.sh -parameters "--bypass-disclaimer -d"

Install the XMDE Client Analyzer

Download and extract the XMDE Client Analyzer. You can use either the binary or Python version, as follows:

Due to the limited commands available in live response, the steps detailed must be executed in a bash script. By splitting the installation and execution portion of these commands, it's possible to run the install script once, and run the execution script multiple times.

Important

The example scripts assume the machine has direct internet access and can retrieve the XMDE Client Analyzer from Microsoft. If the machine doesn't have direct internet access, then the installation scripts must be updated to fetch the XMDE Client Analyzer from a location the machines can access successfully.

Binary client analyzer install script

The following script performs the first six steps of the Running the Binary version of the Client Analyzer. When complete, the XMDE Client Analyzer binary is available from the /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer directory.

  • Create a bash file InstallXMDEClientAnalyzer.sh and paste the following content into it.

    #! /usr/bin/bash

echo "Starting Client Analyzer Script. Running As:"
whoami

echo "Getting XMDEClientAnalyzerBinary"
wget --quiet -O /tmp/XMDEClientAnalyzerBinary.zip https://aka.ms/XMDEClientAnalyzerBinary
echo 'C65A4E4C6851D130942BFACD147A9D18B8A92B4F50FACF519477FD1C41A1C323 /tmp/XMDEClientAnalyzerBinary.zip' | sha256sum -c

echo "Unzipping XMDEClientAnalyzerBinary.zip"
unzip -q /tmp/XMDEClientAnalyzerBinary.zip -d /tmp/XMDEClientAnalyzerBinary

echo "Unzipping SupportToolLinuxBinary.zip"
unzip -q /tmp/XMDEClientAnalyzerBinary/XMDEClientAnalyzer/SupportToolLinuxBinary.zip -d /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer

echo "MDESupportTool installed at /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer"

Python client analyzer install script

The following script performs the first six steps of the Running the Python version of the Client Analyzer. When complete, the XMDE Client Analyzer Python scripts are available from the /tmp/XMDEClientAnalyzer directory.

  • Create a bash file InstallXMDEClientAnalyzer.sh and paste the following content into it.

    #! /usr/bin/bash

echo "Starting Client Analyzer Install Script. Running As:"
whoami

echo "Getting XMDEClientAnalyzer.zip"
wget --quiet -O /tmp/XMDEClientAnalyzer.zip https://aka.ms/XMDEClientAnalyzer
echo '07E6A7B89E28A78309D5B6F1E25E4CDFBA9CA141450E422D76441C03AD3477E7 /tmp/XMDEClientAnalyzer.zip' | sha256sum -c

echo "Unzipping XMDEClientAnalyzer.zip"
unzip -q /tmp/XMDEClientAnalyzer.zip -d /tmp/XMDEClientAnalyzer

echo "Setting execute permissions on mde_support_tool.sh script"
cd /tmp/XMDEClientAnalyzer
chmod a+x mde_support_tool.sh

echo "Performing final support tool setup"
./mde_support_tool.sh

Tip

Watch this video to learn more about endpoint settings: Defender for Endpoint client analyzer endpoint settings

Run the client analyzer install scripts

  1. Initiate a Live Response session on the machine you want to investigate.

  2. Select Upload file to library.

  3. Select Choose file.

  4. Select the downloaded file named InstallXMDEClientAnalyzer.sh, and then select Confirm.

  5. While still in the LiveResponse session, use the following commands to install the analyzer:

    run InstallXMDEClientAnalyzer.sh

Run the XMDE client analyzer

Live response doesn't support running the XMDE Client Analyzer or Python directly, so an execution script is necessary.

Important

The following scripts assume the XMDE Client Analyzer was installed using the same locations from the scripts mentioned earlier. If your organization chooses to install the scripts into a different location, then the scripts must be updated to align with your organization's chosen installation location.

Script to execute the binary client analyzer

The binary version of the client analyzer accepts command line parameters to perform different analysis tests. To provide similar capabilities during live response, the execution script takes advantage of the $@ bash variable to pass all input parameters provided to the script to the XMDE Client Analyzer.

  • Create a bash file MDESupportTool.sh and paste the following content into it.

    #! /usr/bin/bash

echo "cd /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer"
cd /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer

echo "Running MDESupportTool"
./MDESupportTool $@

Script to execute Python client analyzer

The Python version of the client analyzer accepts command line parameters to perform different analysis tests. To provide similar capabilities during live response, the execution script takes advantage of the $@ bash variable to pass all input parameters provided to the script to the XMDE Client Analyzer.

  • Create a bash file MDESupportTool.sh and paste the following content into it.

    #! /usr/bin/bash

echo "cd /tmp/XMDEClientAnalyzer"
cd /tmp/XMDEClientAnalyzer

echo "Running mde_support_tool"
./mde_support_tool.sh $@

Run the client analyzer script

Note

If you have an active live response session, you can skip Step 1.

  1. Initiate a Live Response session on the machine you want to investigate.

  2. Select Upload file to library.

  3. Select Choose file.

  4. Select the downloaded file named MDESupportTool.sh, and then select Confirm.

  5. While still in the live response session, use the following commands to run the analyzer and collect the resulting file:

    run MDESupportTool.sh -parameters "--bypass-disclaimer -d"
GetFile "/tmp/your_archive_file_name_here.zip"

\ No newline at end of file \ No newline at end of file

Defender for Endpoint on Linux troubleshooting documents