[Feature Request] Linux support for collecting Antivirus information

[j-ldes]

Your idea

Hi,

My request is basically the same as in this thread but for Linux.

Since you've added the possbility to collect antivirus informations on MacOS (thank you for that!), I would like to know if it's also technically possible for Linux? If so, is there plan to add this?

We've tested Glpi-Agent 1.5 on Ubuntu 22.04 with Microsoft Defender.
It's collected as a software under the name "mdatp" (which is the name of the package) but not in Antivirus.

Thanks for your help!

[g-bougard]

Hi @j-ldes

we don't have actually such plan as generally speaking antivirus are not used (and not really required) on linux. But I can understand it is on scanning servers, like on mail servers or proxy ones.

This is totally possible to add antivirus detection module for linux. We just need to know how to find the required datas. If you can help, I'll be happy to implement it.
Here is a list of the required datas:

• the antivirus name
• its company or editor name
• its version
• the status telling if it is really enabled
• the status telling if it is up-to-date
• its license expiration date if it's applicable
• its base version and eventually the base creation date

The first 2 ones can be set guessed automatically as we are checking if the given antivirus is installed.

Also, you should know such information can be automatically inserted in the inventory by running a external process which has to generate a json file to be included via the additional-content parameter. Here is an example:

• create the /tmp/av.json json file with the following content:

{
	"content": {
		"antivirus": [
			{
				"name": "MS Defender",
				"company": "Microsoft",
				"version": "1.1.1",
				"base_version": "12345.67",
				"base_creation": "20230701.123",
				"enabled": true,
				"uptodate": false,
				"expiration": "2023-09-21"
			}
		]
	}
}

• to test it works, just run the following command as root: glpi-inventory --partial antivirus --additional-content /tmp/av.json

So you can create a script which collect that datas and generate the file. You can schedule that task via crontab, or you can create a deploy task which will only launch that script and if you force the deploy task to be run before the inventory one with the tasks parameter you'll have guarantee to have the latest information.
Finally, if you provide the script you're using, I can implement its logic in the agent module so you won't have to maintain it.

P.S.: the antivirus property must be defined as an array as many antivirus could be theoretically be found.

[j-ldes]

Hi @g-bougard,

Thanks for your reply!

So as you suggested, I was able to get the required data with a Perl script that run the command "mdatp health --output json"
You can download the script in attached files.
get_mdatp_infos.pl.txt

{
  "content": {
    "antivirus": {
      "name": "Microsoft Defender",
      "expiration": "2024-04-10",
      "company": "Microsoft",
      "version": "101.23062.0010",
      "base_version": "1.395.30.0",
      "uptodate": true,
      "base_creation": "1691587153787",
      "enabled": false
    }
  }
}

Secondly, here's the result of "mdatp health" command if needed:

healthy                                     : true
health_issues                               : []
licensed                                    : true
engine_version                              : "1.1.23070.1002"
app_version                                 : "101.23062.0010"
org_id                                      : "***ANONYMIZED***"
log_level                                   : "info"
machine_guid                                : "***ANONYMIZED***"
release_ring                                : "InsiderFast"
product_expiration                          : Apr 10, 2024 at 03:34:28 PM
cloud_enabled                               : true
cloud_automatic_sample_submission_consent   : "safe"
cloud_diagnostic_enabled                    : false
passive_mode_enabled                        : true
behavior_monitoring                         : "disabled"
real_time_protection_enabled                : false
real_time_protection_available              : true
real_time_protection_subsystem              : "fanotify"
supplementary_events_subsystem              : "ebpf"
tamper_protection                           : "disabled"
automatic_definition_update_enabled         : true
definitions_updated                         : Aug 09, 2023 at 03:19:13 PM
definitions_updated_minutes_ago             : 19
definitions_version                         : "1.395.30.0"
definitions_status                          : "up_to_date"
edr_early_preview_enabled                   : "disabled"
edr_device_tags                             : []
edr_group_ids                               : ""
edr_configuration_version                   : "30.199999.main.2023.08.08.11-***ANONYMIZED***"
edr_machine_id                              : "***ANONYMIZED***"
conflicting_applications                    : []
network_protection_status                   : "stopped"
network_protection_enforcement_level        : "disabled"
troubleshooting_mode                        : false

In JSON:

{"$type":"getHealthAllResult","appVersion":"101.23062.0010","automaticDefinitionUpdateEnabled":{"displayValue":true,"isManaged":false,"value":true},"behaviorMonitoring":{"displayValue":true,"isManaged":false,"value":"disabled"},"cloudAutomaticSampleSubmissionConsent":{"displayValue":true,"isManaged":false,"value":"safe"},"cloudDiagnosticEnabled":{"displayValue":true,"isManaged":false,"value":false},"cloudEnabled":{"displayValue":true,"isManaged":false,"value":true},"conflictingApplications":[],"definitionsStatus":{"$type":"upToDate"},"definitionsUpdated":"1691587153787","definitionsUpdatedMinutesAgo":20,"definitionsVersion":"1.395.30.0","edrConfigurationVersion":"30.199999.main.2023.08.08.11-***ANONYMIZED***","edrDeviceTags":{"displayValue":true,"isManaged":false,"value":[]},"edrEarlyPreviewEnabled":{"displayValue":true,"isManaged":false,"value":"disabled"},"edrGroupIds":{"displayValue":true,"isManaged":false,"value":""},"edrMachineId":"***ANONYMIZED***","engineVersion":"1.1.23070.1002","functionalityMode":{"displayValue":false,"isManaged":false,"value":"default"},"healthIssues":[],"healthy":true,"licensed":true,"logLevel":"info","machineGuid":"***ANONYMIZED***","managedBy":{"displayValue":false,"isManaged":false,"value":""},"networkProtectionEnforcementLevel":{"displayValue":true,"isManaged":false,"value":"disabled"},"networkProtectionStatus":"stopped","orgId":"***ANONYMIZED***","passiveModeEnabled":{"displayValue":true,"isManaged":false,"value":true},"productExpiration":"1712756068000","proxy":{"displayValue":false,"isManaged":false,"value":"None"},"realTimeProtectionAvailable":true,"realTimeProtectionEnabled":{"displayValue":true,"isManaged":false,"value":false},"realTimeProtectionSubsystem":"fanotify","releaseRing":"InsiderFast","supplementaryEventsSubsystem":"ebpf","tamperProtection":{"displayValue":true,"isManaged":false,"value":"disabled"},"telemetryClient":{"displayValue":false,"isManaged":false,"value":"OneDs"},"troubleshootingMode":false}

Lastly, I tried to send the partial inventory to GLPI with theses commands:

sudo glpi-inventory --partial antivirus --additional-content /tmp/glpi-agent_antivirus.json --json > /tmp/glpi_partial_inventory.json
sudo glpi-injector --file /tmp/glpi_partial_inventory.json --url https://glpi.domain.com/front/inventory.php

But sadly, it throw the following error:

ERROR: 400 Bad Request, JSON does not validate. Violations:
Array expected, {"base_creation":"1691587153787","base_version":"1.395.30.0","company":"Microsoft","enabled":false,"expiration":"2024-04-10","name":"Microsoft Defender","uptodate":true,"version":"101.23062.0010"} r (...)
These elements were not sent:
/tmp/glpi_partial_inventory.json

Don't know if you need anything else.
Thanks for your help!

[g-bougard]

Hi @j-ldes

big thank you for your work and my apologize for my mistake: as we can find more than one antivirus on a computer, this must be defined as an array. I updated my first post with the right syntax for the json. Indeed I failed to shared the file I used for my test. Sorry again.

Also thank you for the script sharing. It will be easy to integrate in glpi-agent. Also thank you for the output, I'll use it to add a unit test.

[g-bougard]

Thank to your involvement:

1. I added MS Defender support on Linux, see 99a04c9 and I finally mostly reused the code from the MacOSX support
2. I also fixed the expiration date support on MacOSX

You should be able to validate that support in next nightly build.

[j-ldes]

Hello @g-bougard

Thanks a lot for the quick replies and for adding this feature!
I'll test the nightlty build and script with the right json syntax tomorrow :)

[j-ldes]

Hi @g-bougard

I've just installed the GLPI-Agent v1.6-git99a04c90 nightly build on my Ubuntu 22.04, and it worked :)

Also, i've updated the json syntax to create an array, and it also worked.
So, both the script and the feature in the agent are working.

Thanks a lot for your help!