Install Defender for IoT micro agent for Edge

This article explains how to install and set up the Defender micro agent for Edge. The micro agent runs as a module on Azure IoT Edge devices. It monitors security threats and helps manage your IoT security posture. Before you begin, make sure you complete the prerequisites. You'll learn how to add the required package sources, install the agent on Debian and Ubuntu-based Linux systems, and check that it works.

Note

Defender for IoT plans to retire the micro agent on June 1, 2027.

Prerequisites

Before you install the Defender micro agent for Edge, complete the following prerequisites:

  1. Navigate to your IoT Hub or, create a new IoT hub.

  2. Register an IoT Edge device in IoT Hub and retrieve the device connection strings.

  3. Add the appropriate Microsoft package repository.

  4. Download the repository configuration that matches your device operating system.

    • For Ubuntu 18.04:

      curl https://packages.microsoft.com/config/ubuntu/18.04/multiarch/prod.list > ./microsoft-prod.list

    • For Ubuntu 20.04

      curl https://packages.microsoft.com/config/ubuntu/20.04/prod.list > ./microsoft-prod.list

    • For Debian 9 (both AMD64 and ARM64)

      curl https://packages.microsoft.com/config/debian/stretch/multiarch/prod.list > ./microsoft-prod.list

  5. Copy the repository configuration to the sources.list.d directory.

    sudo cp ./microsoft-prod.list /etc/apt/sources.list.d/

  6. Update the list of packages from the repository that you added with the following command:

    sudo apt-get update

  7. Install and configure Edge runtime version 1.2

Install the Defender for IoT micro agent for Edge

Perform the following steps to install and validate the Defender for IoT micro agent on supported Linux distributions.

  1. Install the Defender micro agent package. Run the following command on Debian or Ubuntu-based Linux systems:

    sudo apt-get install defender-iot-micro-agent-edge

  2. Validate your installation.

    1. Ensure the micro agent is running properly with the following command:

      systemctl status defender-iot-micro-agent.service

    2. Ensure that the service is stable by making sure it's active and that the uptime of the process is appropriate

      Check to make sure your service is stable and active.

  3. Test the system end-to-end by creating a trigger file on the device. The trigger file causes a baseline scan in the agent that detects the file as a baseline violation.

    Create a file on the file system with the following command:

    sudo touch /tmp/DefenderForIoTOSBaselineTrigger.txt

    A baseline validation failure recommendation occurs in the hub, with a CceId of CIS-debian-9-DEFENDER_FOR_IOT_TEST_CHECKS-0.0:

    The baseline validation failure recommendation that occurs in the hub.

    Allow up to one hour for the baseline validation failure recommendation to appear in your IoT Hub.

  4. Install a specific version of the Defender IoT micro agent, use the following command:

    sudo apt-get install defender-iot-micro-agent-edge=<version>

Next step

Configure Microsoft Defender for IoT agent-based solution

  • Last updated on