LinuxDIY Test Alerts not generating in MDE after onboarding linux server

For Linux, the documented expected result of the EDR DIY test is that a detection should be raised after a few minutes in the Microsoft Defender portal / Microsoft Defender XDR. Since EICAR detections are working, onboarding and AV reporting are at least partially working, but the EDR test path should be validated separately.

Use this end-to-end check:

1. Confirm the device is visible in the Microsoft Defender portal device inventory. The device can take 5–20 minutes to appear after onboarding.
2. Run the Linux EDR DIY test exactly as documented:

      curl -o ~/Downloads/MDE-Linux-EDR-DIY.zip -L https://aka.ms/MDE-Linux-EDR-DIY
      unzip ~/Downloads/MDE-Linux-EDR-DIY.zip
      chmod +x ./mde_linux_edr_diy.sh
      ./mde_linux_edr_diy.sh
   

3. Wait a few minutes, then check in the Defender portal / Microsoft Defender XDR for:
   • the alert details
   • the machine timeline
4. If the activity appears only in the timeline/events but no alert is raised, collect diagnostics from the Linux device:

      sudo mdatp diagnostic create
   

   Then provide the generated diagnostic zip to Microsoft support.

Additional checks supported by the documentation:

• Verify real-time protection is enabled:

    mdatp health --field real_time_protection_enabled
  

  If it is not enabled:

    mdatp config real-time-protection --value enabled
  

• If mdatp is not available from the shell, restore the command symlink:

    sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp
  

• If installation success is in doubt, verify installation logs:

    sudo journalctl --no-pager|grep 'microsoft-mdatp' > installation.log
    grep 'postinstall end' installation.log
  

Supported conclusion from the available documentation:

• EICAR success does not by itself confirm EDR alert generation.
• For the Linux EDR DIY test, the expected behavior is an alert after a few minutes.
• If no alert is generated, the documented next step is to collect diagnostics and engage support with those logs.

• EDR detection test for verifying device's onboarding and reporting services
• Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool
• Deploy Microsoft Defender for Endpoint on Linux manually
• Use installer script based deployment to deploy Microsoft Defender for Endpoint on Linux
• Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux
• Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux