Document Details
Dns Ama Fields
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
windows_tools
Summary
The documentation is heavily focused on Windows DNS servers and the Windows DNS Events via AMA connector. All examples, field mappings, and instructions reference Windows-specific tools and patterns, with no mention of Linux equivalents or how to handle DNS logs from Linux servers. The normalization schema and filtering guidance are tailored exclusively to Windows DNS event fields, and there is no guidance for Linux-based DNS servers or connectors.
Recommendations
- Add equivalent instructions and examples for collecting and normalizing DNS logs from Linux-based DNS servers (e.g., BIND, Unbound, dnsmasq).
- Document how to use the AMA connector (or other connectors) with Linux DNS servers, including setup, supported fields, and normalization schema.
- Provide a comparative table showing both Windows and Linux DNS field mappings to the normalized schema.
- Include cross-platform guidance for filtering and monitoring DNS events, ensuring parity in documentation for both Windows and Linux environments.
- Mention and link to any Linux-specific connectors or extensions available for Microsoft Sentinel.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
 Clean
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|