Document Details

The documentation demonstrates a Windows bias in several areas. Windows-specific event sources (such as Windows Security Events, Windows Forwarded Events, and Windows device logon events) are listed and described in detail, while Linux equivalents (e.g., Linux audit logs, syslog, SSH logins) are not mentioned at all. Device-related enrichments and examples focus exclusively on Windows (e.g., 'Device family: Windows', 'Operating system: Windows 10'), with no reference to Linux, macOS, or other platforms. There are no examples or guidance for Linux-based data sources, connectors, or device insights, and no mention of Linux-specific security events or log schemas. The documentation assumes a Microsoft-centric environment, with Active Directory and Defender for Identity as the only on-premises identity providers, and does not address hybrid or non-Windows scenarios.