SOLVED

MDE for Linux - show logged on users

%3CLINGO-SUB%20id%3D%22lingo-sub-2530149%22%20slang%3D%22en-US%22%3EMDE%20for%20Linux%20-%20show%20logged%20on%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2530149%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20currently%20testing%20MDE%20for%20Linux%20in%20my%20environment%20and%20noticed%20that%20the%20'Logged%20on%20users'%20section%20on%20the%20Device%20page%20in%20Defender%20Security%20Center%20is%20blank%2C%20even%20though%20I%20can%20find%20network%20logon%20events%20within%20the%20event%20Timeline.%26nbsp%3B%20Is%20this%20expected%20behavior%2C%20or%20should%20I%20be%20able%20to%20see%20the%20list%20of%20users%20who%20have%20logged%20into%20a%20machine%20on%20the%20device%20overview%20page%3F%26nbsp%3B%20%26nbsp%3BTesting%20on%20CentOS%207%20with%20the%20latest%20MDE%20for%20Linux%20package%2C%26nbsp%3Bmdatp-101.34.27-1.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2547947%22%20slang%3D%22en-US%22%3ERe%3A%20MDE%20for%20Linux%20-%20show%20logged%20on%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2547947%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F443441%22%20target%3D%22_blank%22%3E%40branfarm%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ELogged%20on%20user%20is%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Enot%20yet%20available%20for%20Linux.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EFor%20more%20information%20on%20what's%20new%20in%20MDE%20for%20Linux%2C%20please%20see%3A%26nbsp%3B%3C%2FSPAN%3E%3CA%20tabindex%3D%22-1%22%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Flinux-whatsnew%3Fview%3Do365-worldwide%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Flinux-whatsnew%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20aria-label%3D%22Link%20What's%20new%20in%20Microsoft%20Defender%20for%20Endpoint%20on%20Linux%20%7C%20Microsoft%20Docs%22%3EWhat's%20new%20in%20Microsoft%20Defender%20for%20Endpoint%20on%20Linux%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

I'm currently testing MDE for Linux in my environment and noticed that the 'Logged on users' section on the Device page in Defender Security Center is blank, even though I can find network logon events within the event Timeline.  Is this expected behavior, or should I be able to see the list of users who have logged into a machine on the device overview page?   Testing on CentOS 7 with the latest MDE for Linux package, mdatp-101.34.27-1.

 

Thanks in advance!

1 Reply
best response confirmed by branfarm (Senior Member)
Solution

@branfarm 

 

Logged on user is not yet available for Linux.

 

For more information on what's new in MDE for Linux, please see: What's new in Microsoft Defender for Endpoint on Linux | Microsoft Docs