2025-10-16 17:07:53,055, INFO - Start executing handler action: install
2025-10-16 17:07:53,055, INFO - MDE installation will occur in 'enable'
2025-10-16 17:07:53,055, INFO - End executing handler action: install
2025-10-16 17:07:54,845, INFO - Start executing handler action: enable
2025-10-16 17:07:54,862, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-16 17:07:54,902, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-16 17:07:54,902, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-16 17:07:54,902, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-16 17:07:54,902, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-16 17:07:54,908, INFO - End executing handler action: enable
2025-10-17 08:05:59,922, INFO - Start executing handler action: enable
2025-10-17 08:05:59,941, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-17 08:05:59,982, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-17 08:05:59,982, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-17 08:05:59,983, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-17 08:05:59,983, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-17 08:05:59,989, INFO - End executing handler action: enable
2025-10-18 08:04:24,299, INFO - Start executing handler action: enable
2025-10-18 08:04:24,319, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-18 08:04:24,358, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-18 08:04:24,358, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-18 08:04:24,358, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-18 08:04:24,358, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-18 08:04:24,363, INFO - End executing handler action: enable
2025-10-19 08:09:12,030, INFO - Start executing handler action: enable
2025-10-19 08:09:12,049, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-19 08:09:12,100, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-19 08:09:12,101, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-19 08:09:12,101, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-19 08:09:12,101, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-19 08:09:12,106, INFO - End executing handler action: enable
2025-10-20 08:11:28,474, INFO - Start executing handler action: enable
2025-10-20 08:11:28,492, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-20 08:11:28,533, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-20 08:11:28,533, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-20 08:11:28,534, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-20 08:11:28,534, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-20 08:11:28,538, INFO - End executing handler action: enable
2025-10-21 08:11:06,083, INFO - Start executing handler action: enable
2025-10-21 08:11:06,116, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-21 08:11:06,156, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-21 08:11:06,157, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-21 08:11:06,157, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-21 08:11:06,157, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-21 08:11:06,166, INFO - End executing handler action: enable
2025-10-22 08:02:25,703, INFO - Start executing handler action: enable
2025-10-22 08:02:25,725, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-22 08:02:25,762, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-22 08:02:25,762, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-22 08:02:25,762, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-22 08:02:25,763, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-22 08:02:25,768, INFO - End executing handler action: enable
2025-10-23 08:09:15,683, INFO - Start executing handler action: enable
2025-10-23 08:09:15,706, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-23 08:09:15,750, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-23 08:09:15,751, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-23 08:09:15,751, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-23 08:09:15,751, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.8/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-23 08:09:15,756, INFO - End executing handler action: enable
2025-10-23 17:42:57,591, INFO - Start executing handler action: disable
2025-10-23 17:42:57,592, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2025-10-23 17:42:57,592, INFO - End executing handler action: disable
2025-10-23 17:42:59,717, INFO - Start executing handler action: update
2025-10-23 17:42:59,718, WARNING - No operation for action: update
2025-10-23 17:42:59,718, INFO - End executing handler action: update
2025-10-23 17:43:01,553, INFO - Start executing handler action: uninstall
2025-10-23 17:43:01,554, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2025-10-23 17:43:01,554, INFO - End executing handler action: uninstall
2025-10-23 17:43:03,619, INFO - Start executing handler action: install
2025-10-23 17:43:03,619, INFO - MDE installation will occur in 'enable'
2025-10-23 17:43:03,620, INFO - End executing handler action: install
2025-10-23 17:43:05,627, INFO - Start executing handler action: enable
2025-10-23 17:43:05,644, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-23 17:43:05,683, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-23 17:43:05,683, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-23 17:43:05,683, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-23 17:43:05,683, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-23 17:43:05,687, INFO - End executing handler action: enable
2025-10-24 08:03:53,223, INFO - Start executing handler action: enable
2025-10-24 08:03:53,246, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-24 08:03:53,288, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-24 08:03:53,288, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-24 08:03:53,289, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-24 08:03:53,289, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-24 08:03:53,293, INFO - End executing handler action: enable
2025-10-25 08:11:05,803, INFO - Start executing handler action: enable
2025-10-25 08:11:05,820, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-25 08:11:05,859, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-25 08:11:05,859, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-25 08:11:05,859, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-25 08:11:05,859, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-25 08:11:05,864, INFO - End executing handler action: enable
2025-10-26 08:04:43,696, INFO - Start executing handler action: enable
2025-10-26 08:04:43,717, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-26 08:04:43,757, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-26 08:04:43,757, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-26 08:04:43,757, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-26 08:04:43,758, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-26 08:04:43,764, INFO - End executing handler action: enable
2025-10-27 08:11:37,007, INFO - Start executing handler action: enable
2025-10-27 08:11:37,029, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-27 08:11:37,072, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-27 08:11:37,073, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-27 08:11:37,074, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-27 08:11:37,075, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-27 08:11:37,080, INFO - End executing handler action: enable
2025-10-28 08:08:56,913, INFO - Start executing handler action: enable
2025-10-28 08:08:56,934, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-28 08:08:56,974, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-28 08:08:56,974, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-28 08:08:56,975, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-28 08:08:56,975, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-28 08:08:56,980, INFO - End executing handler action: enable
2025-10-29 08:02:52,298, INFO - Start executing handler action: enable
2025-10-29 08:02:52,320, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-29 08:02:52,355, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-29 08:02:52,355, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-29 08:02:52,355, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-29 08:02:52,355, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-29 08:02:52,360, INFO - End executing handler action: enable
2025-10-30 08:03:09,780, INFO - Start executing handler action: enable
2025-10-30 08:03:09,800, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-30 08:03:09,839, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-30 08:03:09,839, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-30 08:03:09,839, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-30 08:03:09,839, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-30 08:03:09,844, INFO - End executing handler action: enable
2025-10-30 23:43:07,473, INFO - Start executing handler action: enable
2025-10-30 23:43:07,491, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-30 23:43:07,529, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-30 23:43:07,530, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-30 23:43:07,530, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-30 23:43:07,530, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-30 23:43:07,535, INFO - End executing handler action: enable
2025-10-31 08:09:31,262, INFO - Start executing handler action: enable
2025-10-31 08:09:31,284, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-10-31 08:09:31,323, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-10-31 08:09:31,323, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-10-31 08:09:31,324, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-10-31 08:09:31,324, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-10-31 08:09:31,328, INFO - End executing handler action: enable
2025-11-01 08:06:33,139, INFO - Start executing handler action: enable
2025-11-01 08:06:33,155, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-01 08:06:33,192, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-01 08:06:33,192, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-01 08:06:33,192, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-01 08:06:33,192, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-01 08:06:33,196, INFO - End executing handler action: enable
2025-11-02 08:08:27,751, INFO - Start executing handler action: enable
2025-11-02 08:08:27,771, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-02 08:08:27,814, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-02 08:08:27,814, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-02 08:08:27,814, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-02 08:08:27,814, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-02 08:08:27,819, INFO - End executing handler action: enable
2025-11-03 08:07:51,869, INFO - Start executing handler action: enable
2025-11-03 08:07:51,907, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-03 08:07:51,954, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-03 08:07:51,955, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-03 08:07:51,955, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-03 08:07:51,955, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-03 08:07:51,959, INFO - End executing handler action: enable
2025-11-04 08:08:43,582, INFO - Start executing handler action: enable
2025-11-04 08:08:43,605, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-04 08:08:43,644, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-04 08:08:43,645, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-04 08:08:43,645, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-04 08:08:43,645, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-04 08:08:43,652, INFO - End executing handler action: enable
2025-11-05 08:02:16,419, INFO - Start executing handler action: enable
2025-11-05 08:02:16,438, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-05 08:02:16,480, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-05 08:02:16,480, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-05 08:02:16,481, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-05 08:02:16,481, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-05 08:02:16,486, INFO - End executing handler action: enable
2025-11-06 08:08:46,795, INFO - Start executing handler action: enable
2025-11-06 08:08:46,823, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-06 08:08:46,860, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-06 08:08:46,860, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-06 08:08:46,861, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-06 08:08:46,861, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-06 08:08:46,869, INFO - End executing handler action: enable
2025-11-07 05:43:14,749, INFO - Start executing handler action: enable
2025-11-07 05:43:14,770, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-07 05:43:14,807, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-07 05:43:14,807, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-07 05:43:14,808, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-07 05:43:14,808, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-07 05:43:14,815, INFO - End executing handler action: enable
2025-11-07 08:11:12,332, INFO - Start executing handler action: enable
2025-11-07 08:11:12,350, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-07 08:11:12,396, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-07 08:11:12,396, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-07 08:11:12,396, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-07 08:11:12,397, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-07 08:11:12,402, INFO - End executing handler action: enable
2025-11-08 08:10:41,855, INFO - Start executing handler action: enable
2025-11-08 08:10:41,887, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-08 08:10:41,928, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-08 08:10:41,928, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-08 08:10:41,928, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-08 08:10:41,928, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-08 08:10:41,936, INFO - End executing handler action: enable
2025-11-09 08:09:20,845, INFO - Start executing handler action: enable
2025-11-09 08:09:20,863, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-09 08:09:20,899, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-09 08:09:20,900, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-09 08:09:20,900, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-09 08:09:20,900, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-09 08:09:20,904, INFO - End executing handler action: enable
2025-11-10 08:02:36,260, INFO - Start executing handler action: enable
2025-11-10 08:02:36,278, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-10 08:02:36,317, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-10 08:02:36,317, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-10 08:02:36,317, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-10 08:02:36,317, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-10 08:02:36,322, INFO - End executing handler action: enable
2025-11-11 08:07:13,332, INFO - Start executing handler action: enable
2025-11-11 08:07:13,353, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-11 08:07:13,405, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-11 08:07:13,406, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-11 08:07:13,406, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-11 08:07:13,406, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-11 08:07:13,411, INFO - End executing handler action: enable
2025-11-12 08:03:00,520, INFO - Start executing handler action: enable
2025-11-12 08:03:00,542, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-12 08:03:00,585, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-12 08:03:00,585, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-12 08:03:00,585, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-12 08:03:00,585, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-12 08:03:00,592, INFO - End executing handler action: enable
2025-11-13 08:03:20,710, INFO - Start executing handler action: enable
2025-11-13 08:03:20,732, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-13 08:03:20,771, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-13 08:03:20,772, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-13 08:03:20,772, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-13 08:03:20,772, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-13 08:03:20,777, INFO - End executing handler action: enable
2025-11-14 08:07:14,486, INFO - Start executing handler action: enable
2025-11-14 08:07:14,506, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-14 08:07:14,550, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-14 08:07:14,550, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-14 08:07:14,550, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-14 08:07:14,550, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-14 08:07:14,555, INFO - End executing handler action: enable
2025-11-14 11:43:11,389, INFO - Start executing handler action: enable
2025-11-14 11:43:11,406, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-14 11:43:11,444, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-14 11:43:11,444, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-14 11:43:11,444, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-14 11:43:11,444, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-14 11:43:11,449, INFO - End executing handler action: enable
2025-11-15 08:11:24,843, INFO - Start executing handler action: enable
2025-11-15 08:11:24,862, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-15 08:11:24,908, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-15 08:11:24,908, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-15 08:11:24,908, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-15 08:11:24,909, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-15 08:11:24,913, INFO - End executing handler action: enable
2025-11-16 08:09:54,416, INFO - Start executing handler action: enable
2025-11-16 08:09:54,434, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-16 08:09:54,475, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-16 08:09:54,476, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-16 08:09:54,476, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-16 08:09:54,476, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-16 08:09:54,481, INFO - End executing handler action: enable
2025-11-17 08:04:13,731, INFO - Start executing handler action: enable
2025-11-17 08:04:13,753, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-17 08:04:13,794, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-17 08:04:13,795, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-17 08:04:13,795, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-17 08:04:13,795, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-17 08:04:13,800, INFO - End executing handler action: enable
2025-11-18 08:08:03,313, INFO - Start executing handler action: enable
2025-11-18 08:08:03,334, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-18 08:08:03,374, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-18 08:08:03,375, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-18 08:08:03,375, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-18 08:08:03,375, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-18 08:08:03,379, INFO - End executing handler action: enable
2025-11-19 08:09:19,284, INFO - Start executing handler action: enable
2025-11-19 08:09:19,303, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-19 08:09:19,344, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-19 08:09:19,345, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-19 08:09:19,345, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-19 08:09:19,345, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-19 08:09:19,349, INFO - End executing handler action: enable
2025-11-20 08:02:21,103, INFO - Start executing handler action: enable
2025-11-20 08:02:21,130, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-20 08:02:21,172, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-20 08:02:21,172, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-20 08:02:21,172, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-20 08:02:21,173, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-20 08:02:21,181, INFO - End executing handler action: enable
2025-11-21 08:03:21,232, INFO - Start executing handler action: enable
2025-11-21 08:03:21,251, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/4.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-21 08:03:21,293, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-21 08:03:21,293, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-21 08:03:21,293, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-21 08:03:21,293, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-21 08:03:21,298, INFO - End executing handler action: enable
2025-11-21 17:43:19,300, INFO - Start executing handler action: enable
2025-11-21 17:43:19,316, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-21 17:43:19,352, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-21 17:43:19,352, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-21 17:43:19,352, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-21 17:43:19,352, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-21 17:43:19,356, INFO - End executing handler action: enable
2025-11-22 08:08:31,575, INFO - Start executing handler action: enable
2025-11-22 08:08:31,611, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-22 08:08:31,649, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-22 08:08:31,650, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-22 08:08:31,650, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-22 08:08:31,650, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-22 08:08:31,653, INFO - End executing handler action: enable
2025-11-23 08:02:44,537, INFO - Start executing handler action: enable
2025-11-23 08:02:44,556, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-23 08:02:45,158, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-23 08:02:45,159, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-23 08:02:45,159, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-23 08:02:45,159, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-23 08:02:45,163, INFO - End executing handler action: enable
2025-11-24 08:06:30,287, INFO - Start executing handler action: enable
2025-11-24 08:06:30,305, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-24 08:06:30,344, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-24 08:06:30,344, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-24 08:06:30,344, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-24 08:06:30,344, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-24 08:06:30,348, INFO - End executing handler action: enable
2025-11-25 08:04:20,511, INFO - Start executing handler action: enable
2025-11-25 08:04:20,529, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-25 08:04:20,571, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-25 08:04:20,572, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-25 08:04:20,572, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-25 08:04:20,572, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-25 08:04:20,576, INFO - End executing handler action: enable
2025-11-26 08:04:59,606, INFO - Start executing handler action: enable
2025-11-26 08:04:59,628, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-26 08:04:59,666, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-26 08:04:59,667, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-26 08:04:59,667, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-26 08:04:59,667, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-26 08:04:59,671, INFO - End executing handler action: enable
2025-11-27 08:12:52,462, INFO - Start executing handler action: enable
2025-11-27 08:12:52,479, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-27 08:12:52,518, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-27 08:12:52,518, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-27 08:12:52,519, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-27 08:12:52,519, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-27 08:12:52,523, INFO - End executing handler action: enable
2025-11-28 08:07:58,377, INFO - Start executing handler action: enable
2025-11-28 08:07:58,397, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/5.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-28 08:07:58,438, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-28 08:07:58,439, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-28 08:07:58,439, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-28 08:07:58,439, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-28 08:07:58,444, INFO - End executing handler action: enable
2025-11-28 23:43:08,817, INFO - Start executing handler action: enable
2025-11-28 23:43:08,836, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-28 23:43:08,879, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-28 23:43:08,879, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-28 23:43:08,879, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-28 23:43:08,879, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-28 23:43:08,883, INFO - End executing handler action: enable
2025-11-29 08:10:13,488, INFO - Start executing handler action: enable
2025-11-29 08:10:13,507, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-29 08:10:13,546, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-29 08:10:13,546, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-29 08:10:13,547, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-29 08:10:13,547, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-29 08:10:13,551, INFO - End executing handler action: enable
2025-11-30 08:07:40,291, INFO - Start executing handler action: enable
2025-11-30 08:07:40,321, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-11-30 08:07:40,369, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-11-30 08:07:40,369, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-11-30 08:07:40,369, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-11-30 08:07:40,369, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-11-30 08:07:40,377, INFO - End executing handler action: enable
2025-12-01 08:08:28,856, INFO - Start executing handler action: enable
2025-12-01 08:08:28,877, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-01 08:08:28,918, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-01 08:08:28,918, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-01 08:08:28,918, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-01 08:08:28,918, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-01 08:08:28,923, INFO - End executing handler action: enable
2025-12-02 08:07:15,856, INFO - Start executing handler action: enable
2025-12-02 08:07:15,876, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-02 08:07:15,910, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-02 08:07:15,911, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-02 08:07:15,911, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-02 08:07:15,911, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-02 08:07:15,916, INFO - End executing handler action: enable
2025-12-03 08:10:52,527, INFO - Start executing handler action: enable
2025-12-03 08:10:52,545, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-03 08:10:52,584, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-03 08:10:52,584, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-03 08:10:52,584, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-03 08:10:52,585, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-03 08:10:52,588, INFO - End executing handler action: enable
2025-12-04 08:08:24,086, INFO - Start executing handler action: enable
2025-12-04 08:08:24,105, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-04 08:08:24,146, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-04 08:08:24,146, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-04 08:08:24,147, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-04 08:08:24,147, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-04 08:08:24,151, INFO - End executing handler action: enable
2025-12-05 08:03:49,146, INFO - Start executing handler action: enable
2025-12-05 08:03:49,170, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/6.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-05 08:03:49,215, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-05 08:03:49,216, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-05 08:03:49,216, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-05 08:03:49,216, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-05 08:03:49,221, INFO - End executing handler action: enable
2025-12-06 05:43:18,950, INFO - Start executing handler action: enable
2025-12-06 05:43:18,978, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-06 05:43:19,019, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-06 05:43:19,020, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-06 05:43:19,020, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-06 05:43:19,020, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-06 05:43:19,029, INFO - End executing handler action: enable
2025-12-06 08:07:26,744, INFO - Start executing handler action: enable
2025-12-06 08:07:26,760, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-06 08:07:26,795, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-06 08:07:26,795, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-06 08:07:26,796, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-06 08:07:26,796, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-06 08:07:26,801, INFO - End executing handler action: enable
2025-12-07 08:03:56,365, INFO - Start executing handler action: enable
2025-12-07 08:03:56,383, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-07 08:03:56,427, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-07 08:03:56,427, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-07 08:03:56,427, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-07 08:03:56,427, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-07 08:03:56,432, INFO - End executing handler action: enable
2025-12-08 08:08:14,672, INFO - Start executing handler action: enable
2025-12-08 08:08:14,699, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-08 08:08:14,750, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-08 08:08:14,751, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-08 08:08:14,751, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-08 08:08:14,751, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-08 08:08:14,756, INFO - End executing handler action: enable
2025-12-09 08:07:19,561, INFO - Start executing handler action: enable
2025-12-09 08:07:19,580, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-09 08:07:19,620, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-09 08:07:19,620, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-09 08:07:19,620, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-09 08:07:19,621, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-09 08:07:19,624, INFO - End executing handler action: enable
2025-12-10 08:03:26,065, INFO - Start executing handler action: enable
2025-12-10 08:03:26,091, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-10 08:03:26,133, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-10 08:03:26,133, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-10 08:03:26,133, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-10 08:03:26,134, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-10 08:03:26,140, INFO - End executing handler action: enable
2025-12-11 08:05:17,552, INFO - Start executing handler action: enable
2025-12-11 08:05:17,576, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-11 08:05:17,625, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-11 08:05:17,626, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-11 08:05:17,626, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-11 08:05:17,626, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-11 08:05:17,630, INFO - End executing handler action: enable
2025-12-12 08:11:33,021, INFO - Start executing handler action: enable
2025-12-12 08:11:33,056, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-12 08:11:33,096, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-12 08:11:33,096, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-12 08:11:33,096, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-12 08:11:33,096, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-12 08:11:33,104, INFO - End executing handler action: enable
2025-12-13 08:02:44,182, INFO - Start executing handler action: enable
2025-12-13 08:02:44,209, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/7.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-13 08:02:44,250, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-13 08:02:44,250, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-13 08:02:44,250, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-13 08:02:44,251, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-13 08:02:44,258, INFO - End executing handler action: enable
2025-12-13 11:43:10,693, INFO - Start executing handler action: enable
2025-12-13 11:43:10,711, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-13 11:43:10,744, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-13 11:43:10,744, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-13 11:43:10,744, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-13 11:43:10,744, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-13 11:43:10,749, INFO - End executing handler action: enable
2025-12-14 08:09:25,248, INFO - Start executing handler action: enable
2025-12-14 08:09:25,289, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-14 08:09:25,328, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-14 08:09:25,328, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-14 08:09:25,328, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-14 08:09:25,328, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-14 08:09:25,334, INFO - End executing handler action: enable
2025-12-15 08:07:18,531, INFO - Start executing handler action: enable
2025-12-15 08:07:18,551, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-15 08:07:18,589, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-15 08:07:18,589, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-15 08:07:18,589, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-15 08:07:18,589, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-15 08:07:18,593, INFO - End executing handler action: enable
2025-12-16 08:06:30,052, INFO - Start executing handler action: enable
2025-12-16 08:06:30,074, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-16 08:06:30,112, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-16 08:06:30,112, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-16 08:06:30,112, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-16 08:06:30,112, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-16 08:06:30,117, INFO - End executing handler action: enable
2025-12-17 08:08:42,780, INFO - Start executing handler action: enable
2025-12-17 08:08:42,799, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-17 08:08:42,844, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-17 08:08:42,844, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-17 08:08:42,844, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-17 08:08:42,845, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-17 08:08:42,851, INFO - End executing handler action: enable
2025-12-18 08:07:39,081, INFO - Start executing handler action: enable
2025-12-18 08:07:39,102, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-18 08:07:39,145, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-18 08:07:39,145, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-18 08:07:39,146, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-18 08:07:39,146, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-18 08:07:39,151, INFO - End executing handler action: enable
2025-12-19 08:04:27,402, INFO - Start executing handler action: enable
2025-12-19 08:04:27,422, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-19 08:04:27,460, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-19 08:04:27,461, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-19 08:04:27,461, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-19 08:04:27,461, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-19 08:04:27,466, INFO - End executing handler action: enable
2025-12-20 08:07:00,335, INFO - Start executing handler action: enable
2025-12-20 08:07:00,370, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/8.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-20 08:07:00,413, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-20 08:07:00,413, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-20 08:07:00,414, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-20 08:07:00,414, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-20 08:07:00,420, INFO - End executing handler action: enable
2025-12-20 17:43:02,234, INFO - Start executing handler action: enable
2025-12-20 17:43:02,263, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-20 17:43:02,306, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-20 17:43:02,306, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-20 17:43:02,307, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-20 17:43:02,307, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-20 17:43:02,317, INFO - End executing handler action: enable
2025-12-21 08:04:06,381, INFO - Start executing handler action: enable
2025-12-21 08:04:06,402, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-21 08:04:06,440, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-21 08:04:06,441, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-21 08:04:06,441, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-21 08:04:06,441, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-21 08:04:06,446, INFO - End executing handler action: enable
2025-12-22 08:06:29,935, INFO - Start executing handler action: enable
2025-12-22 08:06:29,960, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-22 08:06:30,005, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-22 08:06:30,005, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-22 08:06:30,005, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-22 08:06:30,006, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-22 08:06:30,012, INFO - End executing handler action: enable
2025-12-23 08:02:53,537, INFO - Start executing handler action: enable
2025-12-23 08:02:53,563, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-23 08:02:53,602, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-23 08:02:53,602, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-23 08:02:53,602, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-23 08:02:53,603, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-23 08:02:53,607, INFO - End executing handler action: enable
2025-12-24 08:07:46,836, INFO - Start executing handler action: enable
2025-12-24 08:07:46,860, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-24 08:07:46,904, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-24 08:07:46,904, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-24 08:07:46,904, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-24 08:07:46,904, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-24 08:07:46,910, INFO - End executing handler action: enable
2025-12-25 08:03:45,663, INFO - Start executing handler action: enable
2025-12-25 08:03:45,684, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-25 08:03:45,726, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-25 08:03:45,726, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-25 08:03:45,726, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-25 08:03:45,726, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-25 08:03:45,730, INFO - End executing handler action: enable
2025-12-26 08:12:34,675, INFO - Start executing handler action: enable
2025-12-26 08:12:34,698, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-26 08:12:34,741, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-26 08:12:34,741, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-26 08:12:34,742, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-26 08:12:34,742, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-26 08:12:34,747, INFO - End executing handler action: enable
2025-12-27 08:04:38,879, INFO - Start executing handler action: enable
2025-12-27 08:04:38,903, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/9.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-27 08:04:38,941, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-27 08:04:38,942, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-27 08:04:38,942, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-27 08:04:38,942, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-27 08:04:38,946, INFO - End executing handler action: enable
2025-12-27 22:33:42,127, INFO - Start executing handler action: enable
2025-12-27 22:33:42,154, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-27 22:33:42,197, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-27 22:33:42,197, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-27 22:33:42,198, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-27 22:33:42,198, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-27 22:33:42,205, INFO - End executing handler action: enable
2025-12-28 08:13:16,338, INFO - Start executing handler action: enable
2025-12-28 08:13:16,367, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-28 08:13:16,407, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-28 08:13:16,407, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-28 08:13:16,408, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-28 08:13:16,408, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-28 08:13:16,414, INFO - End executing handler action: enable
2025-12-29 08:11:53,494, INFO - Start executing handler action: enable
2025-12-29 08:11:53,513, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-29 08:11:53,555, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-29 08:11:53,556, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-29 08:11:53,556, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-29 08:11:53,556, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-29 08:11:53,561, INFO - End executing handler action: enable
2025-12-30 08:05:11,530, INFO - Start executing handler action: enable
2025-12-30 08:05:11,666, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-30 08:05:11,744, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-30 08:05:11,745, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-30 08:05:11,745, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-30 08:05:11,745, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-30 08:05:11,794, INFO - End executing handler action: enable
2025-12-31 08:04:47,015, INFO - Start executing handler action: enable
2025-12-31 08:04:47,200, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2025-12-31 08:04:47,374, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2025-12-31 08:04:47,374, INFO - Successfully retrieved autoUpdate from extension public settings: True
2025-12-31 08:04:47,374, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2025-12-31 08:04:47,374, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2025-12-31 08:04:47,414, INFO - End executing handler action: enable
2026-01-01 08:07:53,196, INFO - Start executing handler action: enable
2026-01-01 08:07:53,377, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-01 08:07:53,532, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-01 08:07:53,532, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-01 08:07:53,532, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-01 08:07:53,532, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-01 08:07:53,571, INFO - End executing handler action: enable
2026-01-02 08:11:23,180, INFO - Start executing handler action: enable
2026-01-02 08:11:23,371, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-02 08:11:23,516, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-02 08:11:23,517, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-02 08:11:23,517, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-02 08:11:23,517, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-02 08:11:23,553, INFO - End executing handler action: enable
2026-01-03 07:52:54,256, INFO - Start executing handler action: enable
2026-01-03 07:52:54,438, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-03 07:52:54,582, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-03 07:52:54,583, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-03 07:52:54,583, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-03 07:52:54,583, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-03 07:52:54,622, INFO - End executing handler action: enable
2026-01-03 08:04:22,560, INFO - Start executing handler action: enable
2026-01-03 08:04:22,695, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/10.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-03 08:04:22,821, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-03 08:04:22,821, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-03 08:04:22,838, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-03 08:04:22,838, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-03 08:04:22,868, INFO - End executing handler action: enable
2026-01-03 23:43:21,597, INFO - Start executing handler action: enable
2026-01-03 23:43:21,793, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-03 23:43:21,936, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-03 23:43:21,937, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-03 23:43:21,937, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-03 23:43:21,937, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-03 23:43:21,968, INFO - End executing handler action: enable
2026-01-04 08:10:24,950, INFO - Start executing handler action: enable
2026-01-04 08:10:25,148, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-04 08:10:25,282, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-04 08:10:25,282, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-04 08:10:25,282, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-04 08:10:25,282, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-04 08:10:25,321, INFO - End executing handler action: enable
2026-01-05 08:07:58,575, INFO - Start executing handler action: enable
2026-01-05 08:07:58,777, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-05 08:07:58,921, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-05 08:07:58,921, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-05 08:07:58,921, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-05 08:07:58,921, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-05 08:07:58,970, INFO - End executing handler action: enable
2026-01-06 08:11:47,788, INFO - Start executing handler action: enable
2026-01-06 08:11:47,809, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-06 08:11:47,844, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-06 08:11:47,845, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-06 08:11:47,845, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-06 08:11:47,845, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-06 08:11:47,850, INFO - End executing handler action: enable
2026-01-07 08:10:02,422, INFO - Start executing handler action: enable
2026-01-07 08:10:02,469, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-07 08:10:02,517, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-07 08:10:02,517, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-07 08:10:02,517, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-07 08:10:02,518, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-07 08:10:02,524, INFO - End executing handler action: enable
2026-01-08 08:02:43,075, INFO - Start executing handler action: enable
2026-01-08 08:02:43,097, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-08 08:02:43,138, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-08 08:02:43,138, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-08 08:02:43,138, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-08 08:02:43,139, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-08 08:02:43,143, INFO - End executing handler action: enable
2026-01-09 08:07:24,272, INFO - Start executing handler action: enable
2026-01-09 08:07:24,291, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-09 08:07:24,333, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-09 08:07:24,334, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-09 08:07:24,334, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-09 08:07:24,334, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-09 08:07:24,339, INFO - End executing handler action: enable
2026-01-10 08:08:16,348, INFO - Start executing handler action: enable
2026-01-10 08:08:16,370, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status/11.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-10 08:08:16,411, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-10 08:08:16,411, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-10 08:08:16,411, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-10 08:08:16,412, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.8.9/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-10 08:08:16,416, INFO - End executing handler action: enable
2026-01-11 05:43:22,563, INFO - Start executing handler action: disable
2026-01-11 05:43:22,565, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-01-11 05:43:22,565, INFO - End executing handler action: disable
2026-01-11 05:43:24,560, INFO - Start executing handler action: update
2026-01-11 05:43:24,560, WARNING - No operation for action: update
2026-01-11 05:43:24,560, INFO - End executing handler action: update
2026-01-11 05:43:26,418, INFO - Start executing handler action: uninstall
2026-01-11 05:43:26,419, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-01-11 05:43:26,419, INFO - End executing handler action: uninstall
2026-01-11 05:43:28,493, INFO - Start executing handler action: install
2026-01-11 05:43:28,494, INFO - MDE installation will occur in 'enable'
2026-01-11 05:43:28,494, INFO - End executing handler action: install
2026-01-11 05:43:30,509, INFO - Start executing handler action: enable
2026-01-11 05:43:30,526, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-11 05:43:30,549, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-11 05:43:30,574, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-11 05:43:30,574, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-11 05:43:30,574, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-11 05:43:30,574, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-11 05:43:30,579, INFO - End executing handler action: enable
2026-01-11 08:09:52,559, INFO - Start executing handler action: enable
2026-01-11 08:09:52,577, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-11 08:09:52,588, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-11 08:09:52,614, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-11 08:09:52,614, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-11 08:09:52,614, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-11 08:09:52,614, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-11 08:09:52,619, INFO - End executing handler action: enable
2026-01-12 08:03:27,288, INFO - Start executing handler action: enable
2026-01-12 08:03:27,308, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-12 08:03:27,323, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-12 08:03:27,352, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-12 08:03:27,352, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-12 08:03:27,352, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-12 08:03:27,353, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-12 08:03:27,357, INFO - End executing handler action: enable
2026-01-13 08:13:20,780, INFO - Start executing handler action: enable
2026-01-13 08:13:20,799, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-13 08:13:20,813, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-13 08:13:20,840, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-13 08:13:20,840, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-13 08:13:20,840, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-13 08:13:20,840, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-13 08:13:20,844, INFO - End executing handler action: enable
2026-01-14 08:06:32,845, INFO - Start executing handler action: enable
2026-01-14 08:06:32,865, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-14 08:06:32,883, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-14 08:06:32,912, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-14 08:06:32,912, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-14 08:06:32,913, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-14 08:06:32,913, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-14 08:06:32,918, INFO - End executing handler action: enable
2026-01-15 08:03:40,796, INFO - Start executing handler action: enable
2026-01-15 08:03:40,818, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-15 08:03:40,835, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-15 08:03:40,863, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-15 08:03:40,863, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-15 08:03:40,863, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-15 08:03:40,863, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-15 08:03:40,869, INFO - End executing handler action: enable
2026-01-16 08:07:57,739, INFO - Start executing handler action: enable
2026-01-16 08:07:57,759, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-16 08:07:57,775, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-16 08:07:57,802, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-16 08:07:57,802, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-16 08:07:57,803, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-16 08:07:57,803, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-16 08:07:57,809, INFO - End executing handler action: enable
2026-01-17 08:04:41,071, INFO - Start executing handler action: enable
2026-01-17 08:04:41,091, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-17 08:04:41,107, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-17 08:04:41,135, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-17 08:04:41,135, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-17 08:04:41,135, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-17 08:04:41,135, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-17 08:04:41,140, INFO - End executing handler action: enable
2026-01-18 08:07:35,236, INFO - Start executing handler action: enable
2026-01-18 08:07:35,261, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/12.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-18 08:07:35,278, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-18 08:07:35,303, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-18 08:07:35,303, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-18 08:07:35,303, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-18 08:07:35,303, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-18 08:07:35,309, INFO - End executing handler action: enable
2026-01-18 11:43:39,481, INFO - Start executing handler action: enable
2026-01-18 11:43:39,497, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-18 11:43:39,526, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-18 11:43:39,554, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-18 11:43:39,554, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-18 11:43:39,554, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-18 11:43:39,554, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-18 11:43:39,561, INFO - End executing handler action: enable
2026-01-19 08:02:37,962, INFO - Start executing handler action: enable
2026-01-19 08:02:37,987, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-19 08:02:38,006, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-19 08:02:38,036, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-19 08:02:38,037, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-19 08:02:38,037, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-19 08:02:38,037, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-19 08:02:38,041, INFO - End executing handler action: enable
2026-01-20 08:02:09,579, INFO - Start executing handler action: enable
2026-01-20 08:02:09,600, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-20 08:02:09,619, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-20 08:02:09,643, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-20 08:02:09,644, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-20 08:02:09,644, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-20 08:02:09,644, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-20 08:02:09,649, INFO - End executing handler action: enable
2026-01-21 08:06:14,126, INFO - Start executing handler action: enable
2026-01-21 08:06:14,146, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-21 08:06:14,163, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-21 08:06:14,192, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-21 08:06:14,192, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-21 08:06:14,193, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-21 08:06:14,193, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-21 08:06:14,197, INFO - End executing handler action: enable
2026-01-22 08:07:07,852, INFO - Start executing handler action: enable
2026-01-22 08:07:07,872, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-22 08:07:07,886, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-22 08:07:07,913, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-22 08:07:07,913, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-22 08:07:07,913, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-22 08:07:07,913, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-22 08:07:07,917, INFO - End executing handler action: enable
2026-01-23 08:11:37,572, INFO - Start executing handler action: enable
2026-01-23 08:11:37,593, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-23 08:11:37,609, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-23 08:11:37,636, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-23 08:11:37,636, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-23 08:11:37,636, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-23 08:11:37,636, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-23 08:11:37,643, INFO - End executing handler action: enable
2026-01-24 08:08:28,479, INFO - Start executing handler action: enable
2026-01-24 08:08:28,499, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-24 08:08:28,513, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-24 08:08:28,539, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-24 08:08:28,539, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-24 08:08:28,540, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-24 08:08:28,540, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-24 08:08:28,544, INFO - End executing handler action: enable
2026-01-25 08:05:12,548, INFO - Start executing handler action: enable
2026-01-25 08:05:12,571, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/13.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-25 08:05:12,586, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-25 08:05:12,614, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-25 08:05:12,615, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-25 08:05:12,615, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-25 08:05:12,615, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-25 08:05:12,619, INFO - End executing handler action: enable
2026-01-25 17:43:15,043, INFO - Start executing handler action: enable
2026-01-25 17:43:15,063, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-25 17:43:15,120, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-25 17:43:15,145, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-25 17:43:15,146, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-25 17:43:15,146, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-25 17:43:15,146, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-25 17:43:15,151, INFO - End executing handler action: enable
2026-01-26 08:11:27,071, INFO - Start executing handler action: enable
2026-01-26 08:11:27,095, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-26 08:11:27,113, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-26 08:11:27,137, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-26 08:11:27,137, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-26 08:11:27,137, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-26 08:11:27,137, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-26 08:11:27,143, INFO - End executing handler action: enable
2026-01-27 08:05:09,414, INFO - Start executing handler action: enable
2026-01-27 08:05:09,434, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-27 08:05:09,452, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-27 08:05:09,482, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-27 08:05:09,482, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-27 08:05:09,482, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-27 08:05:09,483, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-27 08:05:09,491, INFO - End executing handler action: enable
2026-01-27 18:33:36,994, INFO - Start executing handler action: enable
2026-01-27 18:33:37,019, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-27 18:33:37,030, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-27 18:33:37,055, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-27 18:33:37,055, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-27 18:33:37,055, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-27 18:33:37,055, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-27 18:33:37,060, INFO - End executing handler action: enable
2026-01-28 08:10:38,384, INFO - Start executing handler action: enable
2026-01-28 08:10:38,411, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-28 08:10:38,450, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-28 08:10:38,477, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-28 08:10:38,477, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-28 08:10:38,477, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-28 08:10:38,478, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-28 08:10:38,486, INFO - End executing handler action: enable
2026-01-29 08:06:18,053, INFO - Start executing handler action: enable
2026-01-29 08:06:18,080, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-29 08:06:18,096, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-29 08:06:18,121, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-29 08:06:18,121, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-29 08:06:18,121, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-29 08:06:18,122, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-29 08:06:18,127, INFO - End executing handler action: enable
2026-01-30 08:12:28,332, INFO - Start executing handler action: enable
2026-01-30 08:12:28,359, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-30 08:12:28,374, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-30 08:12:28,398, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-30 08:12:28,399, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-30 08:12:28,399, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-30 08:12:28,399, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-30 08:12:28,407, INFO - End executing handler action: enable
2026-01-31 08:02:11,136, INFO - Start executing handler action: enable
2026-01-31 08:02:11,153, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-01-31 08:02:11,167, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-01-31 08:02:11,192, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-01-31 08:02:11,193, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-01-31 08:02:11,193, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-01-31 08:02:11,193, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-01-31 08:02:11,198, INFO - End executing handler action: enable
2026-02-01 08:06:55,609, INFO - Start executing handler action: enable
2026-02-01 08:06:55,636, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/14.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-01 08:06:55,653, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-01 08:06:55,679, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-01 08:06:55,679, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-01 08:06:55,680, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-01 08:06:55,680, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-01 08:06:55,684, INFO - End executing handler action: enable
2026-02-01 23:58:49,124, INFO - Start executing handler action: enable
2026-02-01 23:58:49,476, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-01 23:58:49,757, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-01 23:58:49,805, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-01 23:58:49,806, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-01 23:58:49,806, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-01 23:58:49,806, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-01 23:58:49,826, INFO - End executing handler action: enable
2026-02-02 08:07:03,082, INFO - Start executing handler action: enable
2026-02-02 08:07:03,105, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-02 08:07:03,124, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-02 08:07:03,155, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-02 08:07:03,156, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-02 08:07:03,156, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-02 08:07:03,156, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-02 08:07:03,162, INFO - End executing handler action: enable
2026-02-03 08:04:41,068, INFO - Start executing handler action: enable
2026-02-03 08:04:41,089, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-03 08:04:41,104, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-03 08:04:41,131, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-03 08:04:41,131, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-03 08:04:41,131, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-03 08:04:41,131, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-03 08:04:41,135, INFO - End executing handler action: enable
2026-02-04 08:03:57,843, INFO - Start executing handler action: enable
2026-02-04 08:03:57,860, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-04 08:03:57,876, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-04 08:03:57,902, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-04 08:03:57,902, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-04 08:03:57,902, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-04 08:03:57,902, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-04 08:03:57,906, INFO - End executing handler action: enable
2026-02-05 08:04:58,054, INFO - Start executing handler action: enable
2026-02-05 08:04:58,081, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-05 08:04:58,100, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-05 08:04:58,128, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-05 08:04:58,128, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-05 08:04:58,128, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-05 08:04:58,129, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-05 08:04:58,134, INFO - End executing handler action: enable
2026-02-06 08:08:26,813, INFO - Start executing handler action: enable
2026-02-06 08:08:26,834, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-06 08:08:26,848, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-06 08:08:26,874, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-06 08:08:26,875, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-06 08:08:26,875, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-06 08:08:26,875, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-06 08:08:26,879, INFO - End executing handler action: enable
2026-02-06 09:17:48,767, INFO - Start executing handler action: enable
2026-02-06 09:17:48,788, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-06 09:17:48,800, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-06 09:17:48,826, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-06 09:17:48,826, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-06 09:17:48,826, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-06 09:17:48,827, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-06 09:17:48,831, INFO - End executing handler action: enable
2026-02-07 08:04:07,052, INFO - Start executing handler action: enable
2026-02-07 08:04:07,091, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-07 08:04:07,108, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-07 08:04:07,133, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-07 08:04:07,134, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-07 08:04:07,134, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-07 08:04:07,134, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-07 08:04:07,142, INFO - End executing handler action: enable
2026-02-08 08:06:56,677, INFO - Start executing handler action: enable
2026-02-08 08:06:56,699, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status/15.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-08 08:06:56,718, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-08 08:06:56,743, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-08 08:06:56,743, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-08 08:06:56,743, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-08 08:06:56,744, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-08 08:06:56,747, INFO - End executing handler action: enable
2026-02-09 05:43:48,632, INFO - Start executing handler action: disable
2026-02-09 05:43:48,634, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-02-09 05:43:48,634, INFO - End executing handler action: disable
2026-02-09 05:43:50,263, INFO - Start executing handler action: update
2026-02-09 05:43:50,263, WARNING - No operation for action: update
2026-02-09 05:43:50,263, INFO - End executing handler action: update
2026-02-09 05:43:52,206, INFO - Start executing handler action: uninstall
2026-02-09 05:43:52,206, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-02-09 05:43:52,207, INFO - End executing handler action: uninstall
2026-02-09 05:43:54,339, INFO - Start executing handler action: install
2026-02-09 05:43:54,339, INFO - MDE installation will occur in 'enable'
2026-02-09 05:43:54,339, INFO - End executing handler action: install
2026-02-09 05:43:56,302, INFO - Start executing handler action: enable
2026-02-09 05:43:56,303, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-09 05:43:56,380, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-09 05:43:56,413, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-09 05:43:56,413, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-09 05:43:56,413, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-09 05:43:56,414, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-09 05:43:56,420, INFO - End executing handler action: enable
2026-02-09 08:07:21,492, INFO - Start executing handler action: enable
2026-02-09 08:07:21,494, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-09 08:07:21,521, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-09 08:07:21,544, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-09 08:07:21,544, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-09 08:07:21,545, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-09 08:07:21,545, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-09 08:07:21,549, INFO - End executing handler action: enable
2026-02-10 08:02:37,202, INFO - Start executing handler action: enable
2026-02-10 08:02:37,204, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-10 08:02:37,240, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-10 08:02:37,265, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-10 08:02:37,265, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-10 08:02:37,266, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-10 08:02:37,266, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-10 08:02:37,270, INFO - End executing handler action: enable
2026-02-11 08:05:57,962, INFO - Start executing handler action: enable
2026-02-11 08:05:57,987, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-11 08:05:58,260, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-11 08:05:58,306, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-11 08:05:58,307, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-11 08:05:58,307, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-11 08:05:58,307, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-11 08:05:58,342, INFO - End executing handler action: enable
2026-02-12 08:10:53,263, INFO - Start executing handler action: enable
2026-02-12 08:10:53,267, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-12 08:10:53,302, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-12 08:10:53,328, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-12 08:10:53,328, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-12 08:10:53,328, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-12 08:10:53,329, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-12 08:10:53,333, INFO - End executing handler action: enable
2026-02-13 08:08:46,983, INFO - Start executing handler action: enable
2026-02-13 08:08:46,986, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-13 08:08:47,022, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-13 08:08:47,046, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-13 08:08:47,046, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-13 08:08:47,047, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-13 08:08:47,047, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-13 08:08:47,053, INFO - End executing handler action: enable
2026-02-14 08:09:17,049, INFO - Start executing handler action: enable
2026-02-14 08:09:17,052, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-14 08:09:17,090, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-14 08:09:17,118, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-14 08:09:17,118, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-14 08:09:17,118, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-14 08:09:17,118, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-14 08:09:17,122, INFO - End executing handler action: enable
2026-02-15 08:09:53,128, INFO - Start executing handler action: enable
2026-02-15 08:09:53,133, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/16.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-15 08:09:53,170, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-15 08:09:53,196, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-15 08:09:53,196, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-15 08:09:53,196, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-15 08:09:53,197, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-15 08:09:53,202, INFO - End executing handler action: enable
2026-02-16 06:05:33,028, INFO - Start executing handler action: enable
2026-02-16 06:05:33,031, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-16 06:05:33,069, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-16 06:05:33,093, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-16 06:05:33,093, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-16 06:05:33,094, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-16 06:05:33,094, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-16 06:05:33,098, INFO - End executing handler action: enable
2026-02-16 08:02:17,765, INFO - Start executing handler action: enable
2026-02-16 08:02:17,766, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-16 08:02:17,797, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-16 08:02:17,821, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-16 08:02:17,821, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-16 08:02:17,821, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-16 08:02:17,822, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-16 08:02:17,826, INFO - End executing handler action: enable
2026-02-17 08:11:27,876, INFO - Start executing handler action: enable
2026-02-17 08:11:27,878, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-17 08:11:27,910, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-17 08:11:27,933, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-17 08:11:27,933, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-17 08:11:27,933, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-17 08:11:27,933, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-17 08:11:27,937, INFO - End executing handler action: enable
2026-02-18 08:06:03,897, INFO - Start executing handler action: enable
2026-02-18 08:06:03,900, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-18 08:06:03,993, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-18 08:06:04,028, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-18 08:06:04,028, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-18 08:06:04,028, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-18 08:06:04,028, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-18 08:06:04,040, INFO - End executing handler action: enable
2026-02-19 01:22:28,702, INFO - Start executing handler action: enable
2026-02-19 01:22:28,776, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-19 01:22:28,868, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-19 01:22:28,899, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-19 01:22:28,900, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-19 01:22:28,900, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-19 01:22:28,900, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-19 01:22:28,910, INFO - End executing handler action: enable
2026-02-19 08:08:47,656, INFO - Start executing handler action: enable
2026-02-19 08:08:47,659, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-19 08:08:47,696, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-19 08:08:47,722, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-19 08:08:47,722, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-19 08:08:47,722, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-19 08:08:47,723, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-19 08:08:47,727, INFO - End executing handler action: enable
2026-02-20 08:03:20,559, INFO - Start executing handler action: enable
2026-02-20 08:03:20,561, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-20 08:03:20,596, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-20 08:03:20,621, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-20 08:03:20,621, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-20 08:03:20,621, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-20 08:03:20,622, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-20 08:03:20,629, INFO - End executing handler action: enable
2026-02-21 08:09:52,366, INFO - Start executing handler action: enable
2026-02-21 08:09:52,368, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-21 08:09:52,397, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-21 08:09:52,424, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-21 08:09:52,424, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-21 08:09:52,424, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-21 08:09:52,425, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-21 08:09:52,431, INFO - End executing handler action: enable
2026-02-22 08:10:46,709, INFO - Start executing handler action: enable
2026-02-22 08:10:46,712, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-22 08:10:46,746, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-22 08:10:46,771, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-22 08:10:46,771, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-22 08:10:46,771, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-22 08:10:46,771, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-22 08:10:46,777, INFO - End executing handler action: enable
2026-02-23 08:11:15,771, INFO - Start executing handler action: enable
2026-02-23 08:11:15,774, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/17.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-23 08:11:15,819, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-23 08:11:15,845, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-23 08:11:15,846, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-23 08:11:15,846, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-23 08:11:15,846, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-23 08:11:15,855, INFO - End executing handler action: enable
2026-02-23 11:43:26,546, INFO - Start executing handler action: enable
2026-02-23 11:43:26,548, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-23 11:43:26,583, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-23 11:43:26,608, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-23 11:43:26,609, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-23 11:43:26,609, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-23 11:43:26,609, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-23 11:43:26,614, INFO - End executing handler action: enable
2026-02-24 08:06:28,152, INFO - Start executing handler action: enable
2026-02-24 08:06:28,155, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-24 08:06:28,200, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-24 08:06:28,226, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-24 08:06:28,227, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-24 08:06:28,227, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-24 08:06:28,227, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-24 08:06:28,232, INFO - End executing handler action: enable
2026-02-25 08:04:16,947, INFO - Start executing handler action: enable
2026-02-25 08:04:16,950, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-25 08:04:16,984, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-25 08:04:17,009, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-25 08:04:17,009, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-25 08:04:17,009, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-25 08:04:17,009, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-25 08:04:17,017, INFO - End executing handler action: enable
2026-02-25 11:20:08,598, INFO - Start executing handler action: enable
2026-02-25 11:20:08,599, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-25 11:20:08,632, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-25 11:20:08,657, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-25 11:20:08,657, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-25 11:20:08,657, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-25 11:20:08,658, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-25 11:20:08,662, INFO - End executing handler action: enable
2026-02-26 12:10:32,625, INFO - Start executing handler action: enable
2026-02-26 12:10:32,629, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-26 12:10:32,665, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-26 12:10:32,690, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-26 12:10:32,691, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-26 12:10:32,691, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-26 12:10:32,691, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-26 12:10:32,696, INFO - End executing handler action: enable
2026-02-27 08:03:20,809, INFO - Start executing handler action: enable
2026-02-27 08:03:20,810, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-27 08:03:20,836, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-27 08:03:20,859, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-27 08:03:20,860, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-27 08:03:20,860, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-27 08:03:20,860, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-27 08:03:20,864, INFO - End executing handler action: enable
2026-02-28 08:02:32,480, INFO - Start executing handler action: enable
2026-02-28 08:02:32,481, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-02-28 08:02:32,508, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-02-28 08:02:32,538, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-02-28 08:02:32,539, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-02-28 08:02:32,539, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-02-28 08:02:32,539, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-02-28 08:02:32,545, INFO - End executing handler action: enable
2026-03-01 08:11:15,466, INFO - Start executing handler action: enable
2026-03-01 08:11:15,468, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-01 08:11:15,499, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-01 08:11:15,525, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-01 08:11:15,525, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-01 08:11:15,525, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-01 08:11:15,525, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-01 08:11:15,531, INFO - End executing handler action: enable
2026-03-02 08:11:13,828, INFO - Start executing handler action: enable
2026-03-02 08:11:13,829, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/18.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-02 08:11:13,857, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-02 08:11:13,884, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-02 08:11:13,884, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-02 08:11:13,885, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-02 08:11:13,885, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-02 08:11:13,890, INFO - End executing handler action: enable
2026-03-02 17:24:42,896, INFO - Start executing handler action: disable
2026-03-02 17:24:42,897, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-03-02 17:24:42,897, INFO - End executing handler action: disable
2026-03-02 17:24:45,120, INFO - Start executing handler action: update
2026-03-02 17:24:45,122, WARNING - No operation for action: update
2026-03-02 17:24:45,122, INFO - End executing handler action: update
2026-03-02 17:24:46,912, INFO - Start executing handler action: uninstall
2026-03-02 17:24:46,912, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-03-02 17:24:46,912, INFO - End executing handler action: uninstall
2026-03-02 17:24:49,016, INFO - Start executing handler action: install
2026-03-02 17:24:49,016, INFO - MDE installation will occur in 'enable'
2026-03-02 17:24:49,016, INFO - End executing handler action: install
2026-03-02 17:24:51,033, INFO - Start executing handler action: enable
2026-03-02 17:24:51,034, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-02 17:24:51,061, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-02 17:24:51,088, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-02 17:24:51,088, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-02 17:24:51,088, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-02 17:24:51,088, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-02 17:24:51,094, INFO - End executing handler action: enable
2026-03-03 08:07:38,941, INFO - Start executing handler action: enable
2026-03-03 08:07:38,942, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-03 08:07:38,975, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-03 08:07:38,999, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-03 08:07:38,999, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-03 08:07:39,000, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-03 08:07:39,000, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-03 08:07:39,007, INFO - End executing handler action: enable
2026-03-04 08:06:25,219, INFO - Start executing handler action: enable
2026-03-04 08:06:25,220, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-04 08:06:25,249, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-04 08:06:25,275, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-04 08:06:25,275, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-04 08:06:25,275, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-04 08:06:25,275, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-04 08:06:25,281, INFO - End executing handler action: enable
2026-03-05 08:11:51,630, INFO - Start executing handler action: enable
2026-03-05 08:11:51,631, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-05 08:11:51,653, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-05 08:11:51,678, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-05 08:11:51,678, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-05 08:11:51,679, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-05 08:11:51,679, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-05 08:11:51,683, INFO - End executing handler action: enable
2026-03-05 13:14:59,370, INFO - Start executing handler action: enable
2026-03-05 13:14:59,371, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-05 13:14:59,397, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-05 13:14:59,424, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-05 13:14:59,424, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-05 13:14:59,425, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-05 13:14:59,425, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-05 13:14:59,429, INFO - End executing handler action: enable
2026-03-05 13:16:32,121, INFO - Start executing handler action: enable
2026-03-05 13:16:32,127, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-05 13:16:32,174, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-05 13:16:32,208, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-05 13:16:32,208, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-05 13:16:32,208, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-05 13:16:32,208, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-05 13:16:32,219, INFO - End executing handler action: enable
2026-03-06 08:07:55,161, INFO - Start executing handler action: enable
2026-03-06 08:07:55,164, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-06 08:07:55,200, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-06 08:07:55,227, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-06 08:07:55,227, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-06 08:07:55,227, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-06 08:07:55,228, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-06 08:07:55,232, INFO - End executing handler action: enable
2026-03-07 08:03:31,456, INFO - Start executing handler action: enable
2026-03-07 08:03:31,458, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-07 08:03:31,489, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-07 08:03:31,512, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-07 08:03:31,512, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-07 08:03:31,513, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-07 08:03:31,513, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-07 08:03:31,517, INFO - End executing handler action: enable
2026-03-08 08:11:20,420, INFO - Start executing handler action: enable
2026-03-08 08:11:20,425, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-08 08:11:20,486, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-08 08:11:20,521, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-08 08:11:20,522, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-08 08:11:20,522, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-08 08:11:20,522, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-08 08:11:20,531, INFO - End executing handler action: enable
2026-03-09 08:03:32,651, INFO - Start executing handler action: enable
2026-03-09 08:03:32,653, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/19.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-09 08:03:32,697, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-09 08:03:32,723, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-09 08:03:32,723, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-09 08:03:32,723, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-09 08:03:32,723, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-09 08:03:32,731, INFO - End executing handler action: enable
2026-03-09 17:43:27,119, INFO - Start executing handler action: enable
2026-03-09 17:43:27,121, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-09 17:43:27,161, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-09 17:43:27,185, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-09 17:43:27,186, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-09 17:43:27,186, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-09 17:43:27,186, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-09 17:43:27,194, INFO - End executing handler action: enable
2026-03-10 08:06:43,537, INFO - Start executing handler action: enable
2026-03-10 08:06:43,540, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-10 08:06:43,574, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-10 08:06:43,600, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-10 08:06:43,601, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-10 08:06:43,601, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-10 08:06:43,601, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-10 08:06:43,606, INFO - End executing handler action: enable
2026-03-11 08:10:05,485, INFO - Start executing handler action: enable
2026-03-11 08:10:05,488, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-11 08:10:05,524, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-11 08:10:05,550, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-11 08:10:05,550, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-11 08:10:05,551, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-11 08:10:05,551, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-11 08:10:05,555, INFO - End executing handler action: enable
2026-03-12 08:05:27,277, INFO - Start executing handler action: enable
2026-03-12 08:05:27,280, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-12 08:05:27,319, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-12 08:05:27,344, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-12 08:05:27,344, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-12 08:05:27,345, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-12 08:05:27,345, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-12 08:05:27,349, INFO - End executing handler action: enable
2026-03-13 08:11:07,167, INFO - Start executing handler action: enable
2026-03-13 08:11:07,173, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-13 08:11:07,216, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-13 08:11:07,244, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-13 08:11:07,245, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-13 08:11:07,245, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-13 08:11:07,245, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-13 08:11:07,250, INFO - End executing handler action: enable
2026-03-14 08:11:08,847, INFO - Start executing handler action: enable
2026-03-14 08:11:08,850, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-14 08:11:08,885, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-14 08:11:08,914, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-14 08:11:08,915, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-14 08:11:08,915, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-14 08:11:08,915, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-14 08:11:08,919, INFO - End executing handler action: enable
2026-03-15 08:09:36,781, INFO - Start executing handler action: enable
2026-03-15 08:09:36,784, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-15 08:09:36,822, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-15 08:09:36,853, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-15 08:09:36,853, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-15 08:09:36,854, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-15 08:09:36,854, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-15 08:09:36,858, INFO - End executing handler action: enable
2026-03-16 08:03:44,482, INFO - Start executing handler action: enable
2026-03-16 08:03:44,485, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/20.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-16 08:03:44,535, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-16 08:03:44,565, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-16 08:03:44,565, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-16 08:03:44,565, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-16 08:03:44,566, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-16 08:03:44,572, INFO - End executing handler action: enable
2026-03-16 23:43:05,413, INFO - Start executing handler action: enable
2026-03-16 23:43:05,415, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-16 23:43:05,468, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-16 23:43:05,493, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-16 23:43:05,493, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-16 23:43:05,493, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-16 23:43:05,494, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-16 23:43:05,500, INFO - End executing handler action: enable
2026-03-17 08:07:49,303, INFO - Start executing handler action: enable
2026-03-17 08:07:49,305, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-17 08:07:49,339, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-17 08:07:49,367, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-17 08:07:49,368, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-17 08:07:49,368, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-17 08:07:49,368, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-17 08:07:49,372, INFO - End executing handler action: enable
2026-03-18 08:08:38,081, INFO - Start executing handler action: enable
2026-03-18 08:08:38,088, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-18 08:08:38,129, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-18 08:08:38,162, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-18 08:08:38,162, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-18 08:08:38,162, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-18 08:08:38,163, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-18 08:08:38,174, INFO - End executing handler action: enable
2026-03-19 08:02:53,430, INFO - Start executing handler action: enable
2026-03-19 08:02:53,432, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-19 08:02:53,482, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-19 08:02:53,508, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-19 08:02:53,508, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-19 08:02:53,508, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-19 08:02:53,509, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-19 08:02:53,513, INFO - End executing handler action: enable
2026-03-20 08:07:18,349, INFO - Start executing handler action: enable
2026-03-20 08:07:18,351, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-20 08:07:18,386, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-20 08:07:18,416, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-20 08:07:18,416, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-20 08:07:18,416, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-20 08:07:18,417, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-20 08:07:18,422, INFO - End executing handler action: enable
2026-03-21 08:05:25,321, INFO - Start executing handler action: enable
2026-03-21 08:05:25,323, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-21 08:05:25,360, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-21 08:05:25,386, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-21 08:05:25,386, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-21 08:05:25,386, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-21 08:05:25,387, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-21 08:05:25,393, INFO - End executing handler action: enable
2026-03-22 08:02:37,302, INFO - Start executing handler action: enable
2026-03-22 08:02:37,310, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-22 08:02:37,349, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-22 08:02:37,376, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-22 08:02:37,377, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-22 08:02:37,377, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-22 08:02:37,377, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-22 08:02:37,385, INFO - End executing handler action: enable
2026-03-23 08:09:14,036, INFO - Start executing handler action: enable
2026-03-23 08:09:14,039, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status/21.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-23 08:09:14,081, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-23 08:09:14,111, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-23 08:09:14,111, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-23 08:09:14,112, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-23 08:09:14,112, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.10.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-23 08:09:14,120, INFO - End executing handler action: enable
2026-03-23 23:44:21,721, INFO - Start executing handler action: disable
2026-03-23 23:44:21,723, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-03-23 23:44:21,723, INFO - End executing handler action: disable
2026-03-23 23:44:23,814, INFO - Start executing handler action: update
2026-03-23 23:44:23,814, WARNING - No operation for action: update
2026-03-23 23:44:23,815, INFO - End executing handler action: update
2026-03-23 23:44:25,648, INFO - Start executing handler action: uninstall
2026-03-23 23:44:25,648, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-03-23 23:44:25,648, INFO - End executing handler action: uninstall
2026-03-23 23:44:27,719, INFO - Start executing handler action: install
2026-03-23 23:44:27,720, INFO - MDE installation will occur in 'enable'
2026-03-23 23:44:27,720, INFO - End executing handler action: install
2026-03-23 23:44:29,715, INFO - Start executing handler action: enable
2026-03-23 23:44:29,716, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-23 23:44:29,744, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-23 23:44:29,769, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-23 23:44:29,769, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-23 23:44:29,770, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-23 23:44:29,770, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-23 23:44:29,774, INFO - End executing handler action: enable
2026-03-24 08:10:57,307, INFO - Start executing handler action: enable
2026-03-24 08:10:57,308, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-24 08:10:57,338, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-24 08:10:57,365, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-24 08:10:57,365, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-24 08:10:57,366, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-24 08:10:57,366, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-24 08:10:57,370, INFO - End executing handler action: enable
2026-03-25 08:10:13,091, INFO - Start executing handler action: enable
2026-03-25 08:10:13,096, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-25 08:10:13,148, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-25 08:10:13,173, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-25 08:10:13,173, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-25 08:10:13,173, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-25 08:10:13,173, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-25 08:10:13,181, INFO - End executing handler action: enable
2026-03-26 08:09:23,162, INFO - Start executing handler action: enable
2026-03-26 08:09:23,164, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-26 08:09:23,200, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-26 08:09:23,226, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-26 08:09:23,226, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-26 08:09:23,227, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-26 08:09:23,227, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-26 08:09:23,232, INFO - End executing handler action: enable
2026-03-27 08:02:47,786, INFO - Start executing handler action: enable
2026-03-27 08:02:47,789, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-27 08:02:47,820, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-27 08:02:47,845, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-27 08:02:47,846, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-27 08:02:47,846, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-27 08:02:47,846, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-27 08:02:47,851, INFO - End executing handler action: enable
2026-03-28 08:08:06,809, INFO - Start executing handler action: enable
2026-03-28 08:08:06,811, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-28 08:08:06,844, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-28 08:08:06,870, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-28 08:08:06,870, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-28 08:08:06,871, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-28 08:08:06,871, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-28 08:08:06,875, INFO - End executing handler action: enable
2026-03-29 08:03:57,753, INFO - Start executing handler action: enable
2026-03-29 08:03:57,756, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-29 08:03:57,791, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-29 08:03:57,816, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-29 08:03:57,816, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-29 08:03:57,816, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-29 08:03:57,816, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-29 08:03:57,820, INFO - End executing handler action: enable
2026-03-30 08:07:49,548, INFO - Start executing handler action: enable
2026-03-30 08:07:49,556, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/22.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-30 08:07:49,590, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-30 08:07:49,617, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-30 08:07:49,618, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-30 08:07:49,618, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-30 08:07:49,618, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-30 08:07:49,622, INFO - End executing handler action: enable
2026-03-31 05:25:20,910, INFO - Start executing handler action: enable
2026-03-31 05:25:20,913, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-31 05:25:20,948, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-31 05:25:20,977, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-31 05:25:20,977, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-31 05:25:20,977, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-31 05:25:20,978, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-31 05:25:20,982, INFO - End executing handler action: enable
2026-03-31 08:04:27,535, INFO - Start executing handler action: enable
2026-03-31 08:04:27,537, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-03-31 08:04:27,567, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-03-31 08:04:27,592, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-03-31 08:04:27,592, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-03-31 08:04:27,592, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-03-31 08:04:27,592, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-03-31 08:04:27,596, INFO - End executing handler action: enable
2026-04-01 08:02:42,459, INFO - Start executing handler action: enable
2026-04-01 08:02:42,462, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-01 08:02:42,491, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-01 08:02:42,519, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-01 08:02:42,519, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-01 08:02:42,519, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-01 08:02:42,519, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-01 08:02:42,523, INFO - End executing handler action: enable
2026-04-02 08:10:07,443, INFO - Start executing handler action: enable
2026-04-02 08:10:07,446, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-02 08:10:07,483, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-02 08:10:07,510, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-02 08:10:07,511, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-02 08:10:07,511, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-02 08:10:07,511, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-02 08:10:07,515, INFO - End executing handler action: enable
2026-04-03 08:10:38,443, INFO - Start executing handler action: enable
2026-04-03 08:10:38,446, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-03 08:10:38,482, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-03 08:10:38,507, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-03 08:10:38,507, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-03 08:10:38,507, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-03 08:10:38,508, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-03 08:10:38,512, INFO - End executing handler action: enable
2026-04-04 08:06:17,311, INFO - Start executing handler action: enable
2026-04-04 08:06:17,323, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-04 08:06:17,414, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-04 08:06:17,450, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-04 08:06:17,450, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-04 08:06:17,451, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-04 08:06:17,451, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-04 08:06:17,472, INFO - End executing handler action: enable
2026-04-05 08:07:22,007, INFO - Start executing handler action: enable
2026-04-05 08:07:22,010, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-05 08:07:22,044, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-05 08:07:22,073, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-05 08:07:22,073, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-05 08:07:22,073, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-05 08:07:22,074, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-05 08:07:22,078, INFO - End executing handler action: enable
2026-04-06 08:04:31,488, INFO - Start executing handler action: enable
2026-04-06 08:04:31,490, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-06 08:04:31,524, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-06 08:04:31,548, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-06 08:04:31,549, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-06 08:04:31,549, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-06 08:04:31,549, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-06 08:04:31,555, INFO - End executing handler action: enable
2026-04-07 08:04:45,424, INFO - Start executing handler action: enable
2026-04-07 08:04:45,427, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/23.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-07 08:04:45,464, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-07 08:04:45,489, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-07 08:04:45,489, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-07 08:04:45,490, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-07 08:04:45,490, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-07 08:04:45,495, INFO - End executing handler action: enable
2026-04-07 11:26:02,357, INFO - Start executing handler action: enable
2026-04-07 11:26:02,358, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-07 11:26:02,396, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-07 11:26:02,420, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-07 11:26:02,420, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-07 11:26:02,421, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-07 11:26:02,421, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-07 11:26:02,426, INFO - End executing handler action: enable
2026-04-08 08:11:20,715, INFO - Start executing handler action: enable
2026-04-08 08:11:20,718, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-08 08:11:20,756, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-08 08:11:20,782, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-08 08:11:20,782, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-08 08:11:20,782, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-08 08:11:20,782, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-08 08:11:20,787, INFO - End executing handler action: enable
2026-04-09 08:10:56,820, INFO - Start executing handler action: enable
2026-04-09 08:10:56,823, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-09 08:10:56,855, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-09 08:10:56,882, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-09 08:10:56,882, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-09 08:10:56,883, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-09 08:10:56,883, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-09 08:10:56,887, INFO - End executing handler action: enable
2026-04-10 08:05:23,876, INFO - Start executing handler action: enable
2026-04-10 08:05:23,878, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-10 08:05:23,911, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-10 08:05:23,934, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-10 08:05:23,935, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-10 08:05:23,935, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-10 08:05:23,935, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-10 08:05:23,942, INFO - End executing handler action: enable
2026-04-11 08:16:56,627, INFO - Start executing handler action: enable
2026-04-11 08:16:56,665, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-11 08:16:57,730, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-11 08:16:57,779, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-11 08:16:57,779, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-11 08:16:57,779, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-11 08:16:57,787, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-11 08:16:57,826, INFO - End executing handler action: enable
2026-04-12 08:04:18,932, INFO - Start executing handler action: enable
2026-04-12 08:04:18,935, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-12 08:04:18,971, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-12 08:04:18,995, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-12 08:04:18,996, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-12 08:04:18,996, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-12 08:04:18,996, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-12 08:04:19,000, INFO - End executing handler action: enable
2026-04-13 08:11:31,679, INFO - Start executing handler action: enable
2026-04-13 08:11:31,710, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/24.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-13 08:11:31,978, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-13 08:11:32,033, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-13 08:11:32,034, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-13 08:11:32,043, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-13 08:11:32,043, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-13 08:11:32,072, INFO - End executing handler action: enable
2026-04-13 11:25:56,437, INFO - Start executing handler action: enable
2026-04-13 11:25:56,441, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/25.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-13 11:25:56,474, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-13 11:25:56,498, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-13 11:25:56,499, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-13 11:25:56,499, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-13 11:25:56,499, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-13 11:25:56,503, INFO - End executing handler action: enable
2026-04-14 08:08:26,840, INFO - Start executing handler action: enable
2026-04-14 08:08:26,849, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/25.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-14 08:08:26,896, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-14 08:08:26,925, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-14 08:08:26,925, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-14 08:08:26,925, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-14 08:08:26,925, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-14 08:08:26,931, INFO - End executing handler action: enable
2026-04-14 11:27:27,305, INFO - Start executing handler action: enable
2026-04-14 11:27:27,307, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-14 11:27:27,334, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-14 11:27:27,359, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-14 11:27:27,359, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-14 11:27:27,360, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-14 11:27:27,360, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-14 11:27:27,364, INFO - End executing handler action: enable
2026-04-15 08:09:14,853, INFO - Start executing handler action: enable
2026-04-15 08:09:14,855, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-15 08:09:14,894, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-15 08:09:14,918, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-15 08:09:14,919, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-15 08:09:14,919, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-15 08:09:14,919, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-15 08:09:14,924, INFO - End executing handler action: enable
2026-04-16 02:15:49,347, INFO - Start executing handler action: enable
2026-04-16 02:15:49,349, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-16 02:15:49,387, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-16 02:15:49,412, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-16 02:15:49,412, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-16 02:15:49,412, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-16 02:15:49,412, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-16 02:15:49,419, INFO - End executing handler action: enable
2026-04-16 08:11:51,360, INFO - Start executing handler action: enable
2026-04-16 08:11:51,362, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-16 08:11:51,393, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-16 08:11:51,418, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-16 08:11:51,419, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-16 08:11:51,419, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-16 08:11:51,419, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-16 08:11:51,427, INFO - End executing handler action: enable
2026-04-17 08:08:25,139, INFO - Start executing handler action: enable
2026-04-17 08:08:25,143, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-17 08:08:25,178, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-17 08:08:25,207, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-17 08:08:25,207, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-17 08:08:25,207, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-17 08:08:25,208, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-17 08:08:25,212, INFO - End executing handler action: enable
2026-04-18 08:11:54,371, INFO - Start executing handler action: enable
2026-04-18 08:11:54,375, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-18 08:11:54,407, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-18 08:11:54,433, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-18 08:11:54,433, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-18 08:11:54,434, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-18 08:11:54,434, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-18 08:11:54,438, INFO - End executing handler action: enable
2026-04-19 08:09:24,860, INFO - Start executing handler action: enable
2026-04-19 08:09:24,863, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-19 08:09:24,900, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-19 08:09:24,928, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-19 08:09:24,929, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-19 08:09:24,929, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-19 08:09:24,929, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-19 08:09:24,937, INFO - End executing handler action: enable
2026-04-20 08:04:56,192, INFO - Start executing handler action: enable
2026-04-20 08:04:56,195, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status/26.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-20 08:04:56,229, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-20 08:04:56,256, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-20 08:04:56,257, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-20 08:04:56,257, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-20 08:04:56,257, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.0/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-20 08:04:56,264, INFO - End executing handler action: enable
2026-04-20 11:43:03,247, INFO - Start executing handler action: disable
2026-04-20 11:43:03,248, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-04-20 11:43:03,248, INFO - End executing handler action: disable
2026-04-20 11:43:05,400, INFO - Start executing handler action: update
2026-04-20 11:43:05,400, WARNING - No operation for action: update
2026-04-20 11:43:05,400, INFO - End executing handler action: update
2026-04-20 11:43:07,236, INFO - Start executing handler action: uninstall
2026-04-20 11:43:07,236, ERROR - Microsoft Defender for Endpoint offboarding is not supported
2026-04-20 11:43:07,237, INFO - End executing handler action: uninstall
2026-04-20 11:43:09,313, INFO - Start executing handler action: install
2026-04-20 11:43:09,313, INFO - MDE installation will occur in 'enable'
2026-04-20 11:43:09,313, INFO - End executing handler action: install
2026-04-20 11:43:11,329, INFO - Start executing handler action: enable
2026-04-20 11:43:11,331, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-20 11:43:11,361, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-20 11:43:11,389, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-20 11:43:11,389, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-20 11:43:11,389, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-20 11:43:11,390, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-20 11:43:11,394, INFO - End executing handler action: enable
2026-04-21 08:06:00,959, INFO - Start executing handler action: enable
2026-04-21 08:06:00,966, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-21 08:06:00,999, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-21 08:06:01,025, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-21 08:06:01,026, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-21 08:06:01,026, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-21 08:06:01,026, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-21 08:06:01,034, INFO - End executing handler action: enable
2026-04-22 08:11:03,811, INFO - Start executing handler action: enable
2026-04-22 08:11:03,814, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-22 08:11:03,849, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-22 08:11:03,878, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-22 08:11:03,879, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-22 08:11:03,879, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-22 08:11:03,879, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-22 08:11:03,884, INFO - End executing handler action: enable
2026-04-23 08:08:11,270, INFO - Start executing handler action: enable
2026-04-23 08:08:11,272, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-23 08:08:11,320, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-23 08:08:11,349, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-23 08:08:11,349, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-23 08:08:11,349, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-23 08:08:11,349, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-23 08:08:11,354, INFO - End executing handler action: enable
2026-04-24 08:03:11,211, INFO - Start executing handler action: enable
2026-04-24 08:03:11,214, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-24 08:03:11,256, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-24 08:03:11,284, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-24 08:03:11,284, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-24 08:03:11,284, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-24 08:03:11,284, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-24 08:03:11,290, INFO - End executing handler action: enable
2026-04-24 19:57:29,687, INFO - Start executing handler action: enable
2026-04-24 19:57:29,707, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/27.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-24 19:57:30,099, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-24 19:57:30,170, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-24 19:57:30,171, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-24 19:57:30,171, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-24 19:57:30,171, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-24 19:57:30,222, INFO - End executing handler action: enable
2026-04-24 23:44:55,229, INFO - Start executing handler action: enable
2026-04-24 23:44:55,250, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/28.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-24 23:44:55,337, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-24 23:44:55,373, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-24 23:44:55,373, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-24 23:44:55,373, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-24 23:44:55,373, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-24 23:44:55,379, INFO - End executing handler action: enable
2026-04-25 08:19:48,846, INFO - Start executing handler action: enable
2026-04-25 08:19:48,859, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/28.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-25 08:19:48,940, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-25 08:19:48,972, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-25 08:19:48,972, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-25 08:19:48,972, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-25 08:19:48,972, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-25 08:19:48,979, INFO - End executing handler action: enable
2026-04-25 11:47:33,406, INFO - Start executing handler action: enable
2026-04-25 11:47:33,413, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-25 11:47:33,505, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-25 11:47:33,540, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-25 11:47:33,540, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-25 11:47:33,540, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-25 11:47:33,540, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-25 11:47:33,556, INFO - End executing handler action: enable
2026-04-26 08:45:22,848, INFO - Start executing handler action: enable
2026-04-26 08:45:22,871, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-26 08:45:23,001, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-26 08:45:23,030, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-26 08:45:23,030, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-26 08:45:23,030, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-26 08:45:23,030, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-26 08:45:23,049, INFO - End executing handler action: enable
2026-04-27 07:19:24,145, INFO - Start executing handler action: enable
2026-04-27 07:19:24,148, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-27 07:19:24,180, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-27 07:19:24,208, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-27 07:19:24,208, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-27 07:19:24,208, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-27 07:19:24,208, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-27 07:19:24,214, INFO - End executing handler action: enable
2026-04-28 07:18:22,254, INFO - Start executing handler action: enable
2026-04-28 07:18:22,256, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-28 07:18:22,289, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-28 07:18:22,317, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-28 07:18:22,318, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-28 07:18:22,318, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-28 07:18:22,318, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-28 07:18:22,322, INFO - End executing handler action: enable
2026-04-29 07:21:25,834, INFO - Start executing handler action: enable
2026-04-29 07:21:25,840, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-29 07:21:25,970, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-29 07:21:26,006, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-29 07:21:26,006, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-29 07:21:26,006, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-29 07:21:26,006, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-29 07:21:26,013, INFO - End executing handler action: enable
2026-04-30 07:23:47,636, INFO - Start executing handler action: enable
2026-04-30 07:23:47,643, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-04-30 07:23:47,678, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-04-30 07:23:47,703, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-04-30 07:23:47,704, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-04-30 07:23:47,704, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-04-30 07:23:47,704, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-04-30 07:23:47,715, INFO - End executing handler action: enable
2026-05-01 07:28:16,912, INFO - Start executing handler action: enable
2026-05-01 07:28:16,930, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-01 07:28:17,222, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-01 07:28:17,274, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-01 07:28:17,274, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-01 07:28:17,274, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-01 07:28:17,275, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-01 07:28:17,329, INFO - End executing handler action: enable
2026-05-02 07:23:44,632, INFO - Start executing handler action: enable
2026-05-02 07:23:44,691, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/29.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-02 07:23:45,484, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-02 07:23:45,537, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-02 07:23:45,537, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-02 07:23:45,538, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-02 07:23:45,538, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-02 07:23:45,668, INFO - End executing handler action: enable
2026-05-02 15:52:22,424, INFO - Start executing handler action: enable
2026-05-02 15:52:22,451, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/30.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-02 15:52:22,709, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-02 15:52:22,753, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-02 15:52:22,753, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-02 15:52:22,753, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-02 15:52:22,754, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-02 15:52:22,789, INFO - End executing handler action: enable
2026-05-03 08:22:59,651, INFO - Start executing handler action: enable
2026-05-03 08:22:59,670, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/30.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-03 08:22:59,910, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-03 08:22:59,951, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-03 08:22:59,951, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-03 08:22:59,951, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-03 08:22:59,951, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-03 08:23:00,008, INFO - End executing handler action: enable
2026-05-04 08:11:39,491, INFO - Start executing handler action: enable
2026-05-04 08:11:39,706, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/30.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-04 08:11:40,788, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-04 08:11:40,840, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-04 08:11:40,840, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-04 08:11:40,840, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-04 08:11:40,841, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-04 08:11:40,924, INFO - End executing handler action: enable
2026-05-04 09:48:54,048, INFO - Start executing handler action: enable
2026-05-04 09:48:54,066, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status/30.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-05-04 09:48:54,301, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-05-04 09:48:54,343, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/briscoewebsite-rg/providers/Microsoft.Compute/virtualMachines/Sparrow
2026-05-04 09:48:54,343, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-05-04 09:48:54,343, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-05-04 09:48:54,343, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.11.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-05-04 09:48:54,385, INFO - End executing handler action: enable
2026-06-03 18:51:28,230, INFO - Start executing handler action: install
2026-06-03 18:51:28,231, INFO - MDE installation will occur in 'enable'
2026-06-03 18:51:28,231, INFO - End executing handler action: install
2026-06-03 18:51:29,523, INFO - Start executing handler action: enable
2026-06-03 18:51:29,524, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-03 18:51:29,672, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-03 18:51:29,698, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-03 18:51:29,698, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-03 18:51:29,698, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-03 18:51:29,699, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-03 18:51:29,703, INFO - End executing handler action: enable
2026-06-04 05:55:54,821, INFO - Start executing handler action: enable
2026-06-04 05:55:54,822, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-04 05:55:54,846, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-04 05:55:54,876, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-04 05:55:54,876, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-04 05:55:54,877, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-04 05:55:54,877, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-04 05:55:54,883, INFO - End executing handler action: enable
2026-06-04 17:26:28,838, INFO - Start executing handler action: enable
2026-06-04 17:26:28,849, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-04 17:26:28,899, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-04 17:26:28,928, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-04 17:26:28,928, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-04 17:26:28,928, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-04 17:26:28,929, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-04 17:26:28,937, INFO - End executing handler action: enable
2026-06-05 15:25:10,353, INFO - Start executing handler action: enable
2026-06-05 15:25:10,363, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-05 15:25:10,423, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-05 15:25:10,445, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-05 15:25:10,445, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-05 15:25:10,445, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-05 15:25:10,445, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-05 15:25:10,450, INFO - End executing handler action: enable
2026-06-05 15:26:44,535, INFO - Start executing handler action: enable
2026-06-05 15:26:44,548, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-05 15:26:44,608, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-05 15:26:44,636, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-05 15:26:44,637, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-05 15:26:44,637, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-05 15:26:44,637, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-05 15:26:44,644, INFO - End executing handler action: enable
2026-06-05 16:38:52,992, INFO - Start executing handler action: enable
2026-06-05 16:38:52,993, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-05 16:38:53,018, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-05 16:38:53,049, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-05 16:38:53,049, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-05 16:38:53,049, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-05 16:38:53,049, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-05 16:38:53,055, INFO - End executing handler action: enable
2026-06-06 00:38:41,937, INFO - Start executing handler action: enable
2026-06-06 00:38:41,939, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-06 00:38:41,992, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-06 00:38:42,022, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-06 00:38:42,022, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-06 00:38:42,022, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-06 00:38:42,022, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-06 00:38:42,029, INFO - End executing handler action: enable
2026-06-07 00:34:29,363, INFO - Start executing handler action: enable
2026-06-07 00:34:29,373, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-07 00:34:29,560, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-07 00:34:29,609, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-07 00:34:29,610, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-07 00:34:29,610, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-07 00:34:29,610, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-07 00:34:29,638, INFO - End executing handler action: enable
2026-06-08 00:33:36,188, INFO - Start executing handler action: enable
2026-06-08 00:33:36,198, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-08 00:33:36,445, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-08 00:33:36,502, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-08 00:33:36,503, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-08 00:33:36,503, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-08 00:33:36,503, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-08 00:33:36,532, INFO - End executing handler action: enable
2026-06-09 00:38:11,105, INFO - Start executing handler action: enable
2026-06-09 00:38:11,152, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-09 00:38:13,573, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-09 00:38:13,614, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-09 00:38:13,614, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-09 00:38:13,632, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-09 00:38:13,632, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-09 00:38:13,737, INFO - End executing handler action: enable
2026-06-10 00:39:22,568, INFO - Start executing handler action: enable
2026-06-10 00:39:22,595, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-10 00:39:23,211, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-10 00:39:23,250, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-10 00:39:23,251, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-10 00:39:23,251, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-10 00:39:23,251, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-10 00:39:23,346, INFO - End executing handler action: enable
2026-06-10 23:24:53,313, INFO - Start executing handler action: enable
2026-06-10 23:24:53,324, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-10 23:24:53,546, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-10 23:24:53,594, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-10 23:24:53,595, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-10 23:24:53,595, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-10 23:24:53,595, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-10 23:24:53,614, INFO - End executing handler action: enable
2026-06-11 00:35:49,940, INFO - Start executing handler action: enable
2026-06-11 00:35:49,941, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-11 00:35:50,080, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-11 00:35:50,120, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-11 00:35:50,126, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-11 00:35:50,127, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-11 00:35:50,127, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-11 00:35:50,145, INFO - End executing handler action: enable
2026-06-19 16:58:58,800, INFO - Start executing handler action: enable
2026-06-19 16:58:58,810, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/1.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-19 16:58:58,905, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-19 16:58:58,942, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-19 16:58:58,942, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-19 16:58:58,942, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-19 16:58:58,942, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-19 16:58:58,955, INFO - End executing handler action: enable
2026-06-19 17:54:22,122, INFO - Start executing handler action: enable
2026-06-19 17:54:22,151, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-19 17:54:22,288, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-19 17:54:22,316, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-19 17:54:22,317, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-19 17:54:22,317, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-19 17:54:22,317, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-19 17:54:22,324, INFO - End executing handler action: enable
2026-06-19 20:00:08,483, INFO - Start executing handler action: enable
2026-06-19 20:00:08,492, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-19 20:00:08,686, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-19 20:00:08,722, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-19 20:00:08,722, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-19 20:00:08,722, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-19 20:00:08,722, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-19 20:00:08,780, INFO - End executing handler action: enable
2026-06-20 00:34:44,274, INFO - Start executing handler action: enable
2026-06-20 00:34:44,294, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-20 00:34:44,562, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-20 00:34:44,602, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-20 00:34:44,603, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-20 00:34:44,603, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-20 00:34:44,603, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-20 00:34:44,641, INFO - End executing handler action: enable
2026-06-21 00:30:49,069, INFO - Start executing handler action: enable
2026-06-21 00:30:49,088, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-21 00:30:49,362, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-21 00:30:49,404, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-21 00:30:49,404, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-21 00:30:49,404, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-21 00:30:49,405, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-21 00:30:49,453, INFO - End executing handler action: enable
2026-06-22 00:38:17,465, INFO - Start executing handler action: enable
2026-06-22 00:38:17,485, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-22 00:38:17,622, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-22 00:38:17,663, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-22 00:38:17,663, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-22 00:38:17,680, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-22 00:38:17,680, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-22 00:38:17,717, INFO - End executing handler action: enable
2026-06-23 00:38:06,460, INFO - Start executing handler action: enable
2026-06-23 00:38:06,479, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-23 00:38:06,694, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-23 00:38:06,744, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-23 00:38:06,744, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-23 00:38:06,744, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-23 00:38:06,745, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-23 00:38:06,772, INFO - End executing handler action: enable
2026-06-24 00:33:30,693, INFO - Start executing handler action: enable
2026-06-24 00:33:30,713, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-24 00:33:30,960, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-24 00:33:31,010, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-24 00:33:31,010, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-24 00:33:31,028, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-24 00:33:31,028, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-24 00:33:31,078, INFO - End executing handler action: enable
2026-06-25 00:46:15,893, INFO - Start executing handler action: enable
2026-06-25 00:46:15,942, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-25 00:46:17,487, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-25 00:46:17,554, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-25 00:46:17,555, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-25 00:46:17,555, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-25 00:46:17,555, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-25 00:46:17,597, INFO - End executing handler action: enable
2026-06-26 00:35:38,313, INFO - Start executing handler action: enable
2026-06-26 00:35:38,341, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/2.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-26 00:35:38,589, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-26 00:35:38,648, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-26 00:35:38,648, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-26 00:35:38,648, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-26 00:35:38,649, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-26 00:35:38,668, INFO - End executing handler action: enable
2026-06-26 23:43:12,329, INFO - Start executing handler action: enable
2026-06-26 23:43:12,348, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-26 23:43:12,610, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-26 23:43:12,653, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-26 23:43:12,654, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-26 23:43:12,654, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-26 23:43:12,654, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-26 23:43:12,701, INFO - End executing handler action: enable
2026-06-27 00:39:13,137, INFO - Start executing handler action: enable
2026-06-27 00:39:13,155, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-27 00:39:13,352, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-27 00:39:13,401, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BRISCOEWEBSITE-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-27 00:39:13,401, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-27 00:39:13,401, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-27 00:39:13,401, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-27 00:39:13,442, INFO - End executing handler action: enable
2026-06-28 00:51:56,301, INFO - Start executing handler action: enable
2026-06-28 00:51:56,466, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-28 00:51:59,004, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-28 00:51:59,063, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-28 00:51:59,063, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-28 00:51:59,063, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-28 00:51:59,064, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-28 00:51:59,073, INFO - End executing handler action: enable
2026-06-29 01:06:37,522, INFO - Start executing handler action: enable
2026-06-29 01:06:37,571, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-29 01:06:37,855, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-29 01:06:37,893, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-29 01:06:37,894, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-29 01:06:37,894, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-29 01:06:37,894, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-29 01:06:37,931, INFO - End executing handler action: enable
2026-06-29 19:49:03,549, INFO - Start executing handler action: enable
2026-06-29 19:49:03,592, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-29 19:49:03,646, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-29 19:49:03,659, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-29 19:49:03,659, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-29 19:49:03,659, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-29 19:49:03,660, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-29 19:49:03,667, INFO - End executing handler action: enable
2026-06-30 00:38:27,582, INFO - Start executing handler action: enable
2026-06-30 00:38:27,584, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-06-30 00:38:27,612, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-06-30 00:38:27,626, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-06-30 00:38:27,626, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-06-30 00:38:27,626, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-06-30 00:38:27,626, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-06-30 00:38:27,632, INFO - End executing handler action: enable
2026-07-01 00:32:53,130, INFO - Start executing handler action: enable
2026-07-01 00:32:53,132, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-07-01 00:32:53,165, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-07-01 00:32:53,188, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-07-01 00:32:53,188, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-07-01 00:32:53,188, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-07-01 00:32:53,189, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-07-01 00:32:53,193, INFO - End executing handler action: enable
2026-07-02 00:37:07,929, INFO - Start executing handler action: enable
2026-07-02 00:37:07,930, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-07-02 00:37:07,954, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-07-02 00:37:07,976, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-07-02 00:37:07,976, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-07-02 00:37:07,977, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-07-02 00:37:07,977, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-07-02 00:37:07,981, INFO - End executing handler action: enable
2026-07-03 00:41:09,640, INFO - Start executing handler action: enable
2026-07-03 00:41:09,641, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status/3.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2026-07-03 00:41:09,667, INFO - Could not reach Azure Instance Metadata Service: <urlopen error [Errno 111] Connection refused>
2026-07-03 00:41:09,687, INFO - Successfully retrieved AzureResourceID from IMDS: /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourceGroups/BriscoeWebsite-RG/providers/Microsoft.Compute/virtualMachines/Sparrow-New-June
2026-07-03 00:41:09,688, INFO - Successfully retrieved autoUpdate from extension public settings: True
2026-07-03 00:41:09,688, INFO - Successfully retrieved defenderForEndpointOnboardingScript from extension protected settings
2026-07-03 00:41:09,688, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --workspaceId 0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338 --azureResourceId /subscriptions/0c6ced9c-a92c-40d4-94a4-b4b5ed6a1338/resourcegroups/briscoewebsite-rg/providers/microsoft.compute/virtualmachines/sparrow-new-june --logFolder /var/log/azure/Microsoft.Azure.AzureDefenderForServers.MDE.Linux --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.14.1/config --autoUpdate TRUE --avMode noAction --onboardingBase64Script <<PII>>
2026-07-03 00:41:09,692, INFO - End executing handler action: enable