Skip to content

Microsoft Defender rollout

Tracking page for the migration of malware protection from ClamAV to Microsoft Defender for Endpoint, across two tracks: workstations and servers. This is the operational counterpart to the playbook's Endpoint Security page and malware-protection control (8.7).

Keep this page updated as the rollout progresses — it is the evidence source the ISMS/audit points to.

Scope & decision

  • What changes: Microsoft Defender for Endpoint replaces ClamAV as the antivirus — on both workstations and Ubuntu LTS servers.
  • What stays: Wazuh remains the endpoint detection / SIEM agent (unchanged, both tracks). Forticlient stays for the Windows-on-KVM case unless decided otherwise.
  • Change record: ClickUp — Migrate antivirus: ClamAV → Microsoft Defender
  • Owner: TODO — name the rollout owner (DevOps).

Status

Track Phase State Date Notes
Workstations Pilot (subset) 🧪 In progress 2026-09 TODO — list pilot machines / users
Workstations Fleet-wide + ClamAV retirement ⏳ Pending — After validation
Servers Planning ⏳ Planned 2026-09 Ubuntu LTS; DevOps-only access
Servers Pilot → fleet-wide → ClamAV retirement ⏳ Pending — After workstation pilot learnings

Current baseline (outside pilot scope): ClamAV remains the operating antivirus on both workstations and servers. Defender is not the baseline control until each track is validated and its rollout completes.

Tracks

Workstations

  • In scope: TODO — Ubuntu / macOS ARM / macOS Intel / Windows-on-KVM.
  • Replaces: ClamAV (see ClamAV antivirus (workstations)).
  • Status: piloting on a subset (2026-09).

Servers

  • In scope: Ubuntu LTS servers (terminal/installation access restricted to the DevOps team).
  • Replaces: ClamAV currently deployed on servers.
  • Status: planned — to start after the workstation pilot is validated so lessons carry over.
  • Extra care: validate no interference with production workloads (CPU/memory, real-time scan exclusions for DB/data dirs); stage per environment (nightly/test before production).

Phases (per track)

  1. Pilot — deploy Defender to a small representative subset; ClamAV stays everywhere else in that track.
  2. Validate — confirm detection, telemetry/onboarding in the Defender portal, no Wazuh conflict, acceptable performance. Record evidence.
  3. Fleet-wide rollout — deploy in waves; track coverage.
  4. Retire ClamAV — remove ClamAV for that track, then update the playbook Endpoint Security page and control 8.7 once both tracks are complete.

Validation / exit criteria (per track)

  • [ ] Agents onboarded and reporting in the Microsoft Defender portal.
  • [ ] Real-time protection + a test detection (e.g. EICAR) confirmed.
  • [ ] No conflict / resource issue alongside the Wazuh agent.
  • [ ] Servers only: no measurable impact on production workloads; scan exclusions set for data/DB paths; rolled out nightly/test → production.
  • [ ] Onboarding is repeatable (documented install steps, below).
  • [ ] Evidence captured (portal screenshots / device list) and linked here.

Install / onboarding steps

Rollback

If a track's pilot fails validation: uninstall the Defender agent on the pilot machines and confirm ClamAV is still active (it is never removed during a pilot). No fleet-wide change is made for that track until validation passes.