%3CLINGO-SUB%20id%3D%22lingo-sub-1577902%22%20slang%3D%22en-US%22%3ELinux%20ATP%20Configuration%20and%20Operation%20Command%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1577902%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHello%20Blog%20Readers%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20have%20summarized%20the%20Linux%20Configuration%20and%20Operation%20commands%20in%20this%20cheat%20sheet%20for%20your%20convenient%20use.%20Enjoy%20Linux%20ATP%20run!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-180px%22%3E%3CFONT%20size%3D%224%22%3E%3CSTRONG%3ELinux%20ATP%20Commands%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-180px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22655%22%3E%0A%3CTHEAD%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3E%3CSTRONG%3EGroup%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3E%3CSTRONG%3EScenario%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3ECommand%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTHEAD%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%2Foff%20real-time%20protection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20config%20real-time-protection%20--value%20%5Benabled%7Cdisabled%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%2Foff%20cloud%20protection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20config%20cloud%20--value%20%5Benabled%7Cdisabled%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%2Foff%20product%20diagnostics%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20config%20cloud-diagnostic%20--value%20%5Benabled%7Cdisabled%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%2Foff%20automatic%20sample%20submission%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20config%20cloud-automatic-sample-submission%20--value%20%5Benabled%7Cdisabled%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%2Foff%20AV%20passive%20mode%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20config%20passive-mode%20%5Benabled%7Cdisabled%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EAdd%2Fremove%20an%20antivirus%20exclusion%20for%20a%20file%20extension%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20exclusion%20extension%20%5Badd%7Cremove%5D%20--name%20%5Bextension%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EAdd%2Fremove%20an%20antivirus%20exclusion%20for%20a%20file%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20exclusion%20file%20%5Badd%7Cremove%5D%20--path%20%5Bpath-to-file%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EAdd%2Fremove%20an%20antivirus%20exclusion%20for%20a%20directory%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20exclusion%20folder%20%5Badd%7Cremove%5D%20--path%20%5Bpath-to-directory%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EAdd%2Fremove%20an%20antivirus%20exclusion%20for%20a%20process%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20exclusion%20process%20%5Badd%7Cremove%5D%20--path%20%5Bpath-to-process%5D%3CBR%20%2F%3Emdatp%20exclusion%20process%20%5Badd%7Cremove%5D%20--name%20%5Bprocess-name%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EList%20all%20antivirus%20exclusions%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20exclusion%20list%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%20PUA%20(Potentially%20Unwanted%20Applications)%20protection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20policy%20set%20--type%20potentially_unwanted_application%20--action%20block%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20off%20PUA%20protection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20policy%20set%20--type%20potentially_unwanted_application%20--action%20off%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EConfiguration%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ETurn%20on%20audit%20mode%20for%20PUA%20protection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20policy%20set%20--type%20potentially_unwanted_application%20--action%20audit%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EDiagnostics%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EChange%20the%20log%20level%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20log%20level%20set%20--level%20verbose%20%5Berror%7Cwarning%7Cinfo%7Cverbose%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EDiagnostics%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EGenerate%20diagnostic%20logs%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20diagnostic%20create%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EHealth%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ECheck%20the%20product's%20health%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20health%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EScan%20a%20path%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20scan%20custom%20--path%20%5Bpath%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EDo%20a%20quick%20scan%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20scan%20quick%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EDo%20a%20full%20scan%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20scan%20full%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ECancel%20an%20ongoing%20on-demand%20scan%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20scan%20cancel%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ERequest%20a%20security%20intelligence%20update%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20definitions%20update%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%20history%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EPrint%20the%20full%20protection%20history%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20list%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EProtection%20history%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EGet%20threat%20details%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20get%20--id%20%5Bthreat-id%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EQuarantine%20management%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EList%20all%20quarantined%20files%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20quarantine%20list%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EQuarantine%20management%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ERemove%20all%20files%20from%20the%20quarantine%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20quarantine%20remove-all%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EQuarantine%20management%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3EAdd%20a%20file%20detected%20as%20a%20threat%20to%20the%20quarantine%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20quarantine%20add%20--id%20%5Bthreat-id%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EQuarantine%20management%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ERemove%20a%20file%20detected%20as%20a%20threat%20from%20the%20quarantine%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20quarantine%20add%20--id%20%5Bthreat-id%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2290%22%3E%3CP%3EQuarantine%20management%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22194%22%3E%3CP%3ERestore%20a%20file%20from%20the%20quarantine%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3Emdatp%20threat%20quarantine%20add%20--id%20%5Bthreat-id%5D%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1295267944%22%20id%3D%22toc-hId--1295267944%22%3E%3CFONT%20size%3D%223%22%3EExamples%3A%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3E%26nbsp%3BTo%20enable%20ATP%20diagnostic%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Emdatp%20config%20cloud-diagnostic%20%E2%80%93value%20enabled%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20check%20ATP%20Configuration%20Settings%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Emdatp%20health%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_0-1597056629964.png%22%20style%3D%22width%3A%20971px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211358iE099E222607CD6CB%2Fimage-dimensions%2F971x561%3Fv%3D1.0%22%20width%3D%22971%22%20height%3D%22561%22%20title%3D%22tantran55_0-1597056629964.png%22%20alt%3D%22tantran55_0-1597056629964.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20Check%20ATP%20Virus%20History%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Emdatp%20threat%20list%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_1-1597056629969.png%22%20style%3D%22width%3A%20962px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211356iFC9D738FFE5F59C3%2Fimage-dimensions%2F962x178%3Fv%3D1.0%22%20width%3D%22962%22%20height%3D%22178%22%20title%3D%22tantran55_1-1597056629969.png%22%20alt%3D%22tantran55_1-1597056629969.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20view%20the%20Quarantine%20list%20and%20remove%20the%20non-threat%20file%20based%20on%20threat%20ID%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Emdatp%20threat%20quarantine%20add%20--id%20%22Your%20threat%20ID%22%0Amdatp%20threat%20quarantine%20list%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_2-1597056629974.png%22%20style%3D%22width%3A%20965px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211357i8F60FD349E7BD679%2Fimage-dimensions%2F965x152%3Fv%3D1.0%22%20width%3D%22965%22%20height%3D%22152%22%20title%3D%22tantran55_2-1597056629974.png%22%20alt%3D%22tantran55_2-1597056629974.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_3-1597056629976.png%22%20style%3D%22width%3A%20956px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211359i2E0C7991CD0CDAC1%2Fimage-dimensions%2F956x53%3Fv%3D1.0%22%20width%3D%22956%22%20height%3D%2253%22%20title%3D%22tantran55_3-1597056629976.png%22%20alt%3D%22tantran55_3-1597056629976.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20Create%20a%20PUA%20Policy%20(Potentially%20Unwanted%20Applications%20Policy)%26nbsp%3B%20in%20audit%20mode%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Emdatp%20threat%20policy%20list%0Amdatp%20threat%20policy%20set%20--type%20potentially_unwanted_application%20--action%20audit%0Amdatp%20threat%20policy%20list%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_4-1597056629980.png%22%20style%3D%22width%3A%20721px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211361i3494C113646045D9%2Fimage-dimensions%2F721x239%3Fv%3D1.0%22%20width%3D%22721%22%20height%3D%22239%22%20title%3D%22tantran55_4-1597056629980.png%22%20alt%3D%22tantran55_4-1597056629980.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20update%20ATP%20Definition%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-bash%22%3E%3CCODE%3Emdatp%20definitions%20update%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22tantran55_5-1597056629984.png%22%20style%3D%22width%3A%20596px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F211360i4FEEE30C3CF9C932%2Fimage-dimensions%2F596x77%3Fv%3D1.0%22%20width%3D%22596%22%20height%3D%2277%22%20title%3D%22tantran55_5-1597056629984.png%22%20alt%3D%22tantran55_5-1597056629984.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMore%20info%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fmicrosoft-defender-atp%2Flinux-resources%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fmicrosoft-defender-atp%2Flinux-resources%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20hope%20the%20command%20list%20is%20helpful.%3C%2FP%3E%0A%3CP%3E___________________________________________________________________________________%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%222%22%3EDisclaimer%3A%20The%20sample%20scripts%20are%20not%20supported%20under%20any%20Microsoft%20standard%20support%20program%20or%20service.%20The%20sample%20scripts%20are%20provided%20AS%20IS%20without%20warranty%20of%20any%20kind.%20Microsoft%20further%20disclaims%20all%20implied%20warranties%20including%2C%20without%20limitation%2C%20any%20implied%20warranties%20of%20merchantability%20or%20of%20fitness%20for%20a%20particular%20purpose.%20The%20entire%20risk%20arising%20out%20of%20the%20use%20or%20performance%20of%20the%20sample%20scripts%20and%20documentation%20remains%20with%20you.%20In%20no%20event%20shall%20Microsoft%2C%20its%20authors%2C%20or%20anyone%20else%20involved%20in%20the%20creation%2C%20production%2C%20or%20delivery%20of%20the%20scripts%20be%20liable%20for%20any%20damages%20whatsoever%20(including%2C%20without%20limitation%2C%20damages%20for%20loss%20of%20business%20profits%2C%20business%20interruption%2C%20loss%20of%20business%20information%2C%20or%20other%20pecuniary%20loss)%20arising%20out%20of%20the%20use%20of%20or%20inability%20to%20use%20the%20sample%20scripts%20or%20documentation%2C%20even%20if%20Microsoft%20has%20been%20advised%20of%20the%20possibility%20of%20such%20damages.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1577902%22%20slang%3D%22en-US%22%3E%3CP%3ELinux%20ATP%20Commands%20list%20for%20daily%20operational%20use%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1577902%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ETanTran%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

 

Hello Blog Readers,

 

I have summarized the Linux Configuration and Operation commands in this cheat sheet for your convenient use. Enjoy Linux ATP run!

 

Linux ATP Commands

 

Group

Scenario

Command

Configuration

Turn on/off real-time protection

mdatp config real-time-protection --value [enabled|disabled]

Configuration

Turn on/off cloud protection

mdatp config cloud --value [enabled|disabled]

Configuration

Turn on/off product diagnostics

mdatp config cloud-diagnostic --value [enabled|disabled]

Configuration

Turn on/off automatic sample submission

mdatp config cloud-automatic-sample-submission --value [enabled|disabled]

Configuration

Turn on/off AV passive mode

mdatp config passive-mode [enabled|disabled]

Configuration

Add/remove an antivirus exclusion for a file extension

mdatp exclusion extension [add|remove] --name [extension]

Configuration

Add/remove an antivirus exclusion for a file

mdatp exclusion file [add|remove] --path [path-to-file]

Configuration

Add/remove an antivirus exclusion for a directory

mdatp exclusion folder [add|remove] --path [path-to-directory]

Configuration

Add/remove an antivirus exclusion for a process

mdatp exclusion process [add|remove] --path [path-to-process]
mdatp exclusion process [add|remove] --name [process-name]

Configuration

List all antivirus exclusions

mdatp exclusion list

Configuration

Turn on PUA (Potentially Unwanted Applications) protection

mdatp threat policy set --type potentially_unwanted_application --action block

Configuration

Turn off PUA protection

mdatp threat policy set --type potentially_unwanted_application --action off

Configuration

Turn on audit mode for PUA protection

mdatp threat policy set --type potentially_unwanted_application --action audit

Diagnostics

Change the log level

mdatp log level set --level verbose [error|warning|info|verbose]

Diagnostics

Generate diagnostic logs

mdatp diagnostic create

Health

Check the product's health

mdatp health

Protection

Scan a path

mdatp scan custom --path [path]

Protection

Do a quick scan

mdatp scan quick

Protection

Do a full scan

mdatp scan full

Protection

Cancel an ongoing on-demand scan

mdatp scan cancel

Protection

Request a security intelligence update

mdatp definitions update

Protection history

Print the full protection history

mdatp threat list

Protection history

Get threat details

mdatp threat get --id [threat-id]

Quarantine management

List all quarantined files

mdatp threat quarantine list

Quarantine management

Remove all files from the quarantine

mdatp threat quarantine remove-all

Quarantine management

Add a file detected as a threat to the quarantine

mdatp threat quarantine add --id [threat-id]

Quarantine management

Remove a file detected as a threat from the quarantine

mdatp threat quarantine add --id [threat-id]

Quarantine management

Restore a file from the quarantine

mdatp threat quarantine add --id [threat-id]

 

Examples:

 To enable ATP diagnostic

 

 

mdatp config cloud-diagnostic –value enabled

 

                             

To check ATP Configuration Settings:

 

 

mdatp health

 

 

tantran55_0-1597056629964.png

 

To Check ATP Virus History

 

 

mdatp threat list

 

 

tantran55_1-1597056629969.png

 

To view the Quarantine list and remove the non-threat file based on threat ID

 

 

mdatp threat quarantine add --id "Your threat ID"
mdatp threat quarantine list

 

 

tantran55_2-1597056629974.png

tantran55_3-1597056629976.png

 

To Create a PUA Policy (Potentially Unwanted Applications Policy)  in audit mode

 

 

mdatp threat policy list
mdatp threat policy set --type potentially_unwanted_application --action audit
mdatp threat policy list

 

 

 tantran55_4-1597056629980.png

 

To update ATP Definition

 

 

mdatp definitions update

 

 

tantran55_5-1597056629984.png

 

More info:

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/linux-res...

 

I hope the command list is helpful.

___________________________________________________________________________________

Disclaimer: The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.