Microsoft Defender ATP antivirus coming to Linux next year

During the 2019 edition of the Ignite conference, Microsoft announced that it is working to provide Linux support on the Microsoft Defender ATP platform (Advanced Threat Protection), which is designed to proactively protect, track uncorrected vulnerabilities, and detect and eliminate malicious activity on the system.

The platform combines an antivirus package, a system to detect intrusions in the network, a mechanism to protect against the exploitation of vulnerabilities (including zero-day ones), tools for advanced isolation, additional tools to manage applications and a system to detect potentially malicious activities.

This movement comes after Microsoft announced in March of this year, the change in the brand antivirus. Previously It was known as Windows Defender, but Microsoft renamed it Microsoft Defender. The company also offered malware protection software for business Mac computers through the Microsoft Defender console. With which the movement now makes sense because the testing of Microsoft Defender ATP for macOS already started a few days ago.

"We plan to offer Microsoft Defender ATP for Linux servers to provide additional protection for our customers' heterogeneous networks," wrote a company executive adding that the solution will arrive on Linux in 2020.

Windows Defender ATP is a security-enabled solution that enables organizations to detect and respond to cyber threats across networks. Advanced Threat Protection (ATP) is a Windows Defender feature that is used in three axes: prevention, investigation, post-detection.

Windows Defender has taken its first steps as spyware in Windows XP. Subsequently, Microsoft has dedicated the same function in Windows Vista and Windows 7. Since Windows 8, the software acts as a complete antivirus solution.

Functionality for non-Windows platforms is still limited by the EDR component (Endpoint Detection and Response), which is responsible for monitoring behavior and analyzing activity using machine learning methods to identify potential attacks, and also includes utilities to study the effects of attacks and respond to potential threats.

Meanwhile Microsoft argues that the tool comes at a good time, as Linux became the victim of serial hacking threats, data breaches and server failures. Although for many it seems "too much benevolence", Microsoft does not make the movements because, since many of those it has made in terms of Linux, are mainly oriented to promote its Azure platform.

In addition to Microsoft Defender ATP it is released in the form of a monthly subscription for companies, which is the "Microsoft Defender ATP E5".

In this sense, it is not surprising if we take the time to do a retrospective. Until the last quarter of 2018, Linux and Windows Server were at odds with Microsoft Azure.

The two operating systems equally shared virtual machines running on Microsoft's cloud platform, but sometimes Linux took over and this was the most common event. This state of affairs can be seen as the result of what began by providing Azure Linux support, to allow various distributions of Linux to be supported on the cloud platform over time.

Today, Microsoft partners are providing Linux images on Azure Marketplace and the company continues to work with different Linux communities to expand the list of distributions compatible with its cloud platform. In the meantime, if a distribution is not available on the Azure Marketplace, it can be integrated by following the instructions provided by Microsoft to create and download a virtual hard disk containing the Linux operating system.

Microsoft Defender ATP for Linux is scheduled to launch next year and a preview version was shown last week at the Ignite 2019 conference. The final product will be available to the public by 2020.

If you want to know more about it, you can check the details In the following link.