Document Details

The documentation page demonstrates a bias toward Windows environments and tooling. Examples and scenarios frequently reference Windows-specific alerts (e.g., Windows Error and Warning Events), PowerShell, and remote WMI execution, with no equivalent Linux or cross-platform examples provided. Windows tools and patterns (PowerShell, WMI) are mentioned exclusively or before any Linux alternatives. There is a lack of Linux-specific detection scenarios, such as those involving Linux audit logs, SSH, or common Linux malware. The documentation does not provide parity for Linux environments in its examples or guidance.