Document Details

The documentation page for Microsoft Sentinel data connectors demonstrates a Windows bias in several areas. Many connectors, especially those related to Microsoft technologies (e.g., Exchange, Active Directory, IIS, Windows Firewall, Windows DNS, Windows Security Events), provide instructions and examples that are specific to Windows environments. Windows tools and concepts (such as Windows Event Logs, Windows agents, and Azure Monitor Agent for Windows) are frequently referenced, often without equivalent Linux instructions or examples. In some cases, the documentation explicitly mentions streaming logs from 'Windows machines' or using 'Windows agents' without parallel Linux guidance, and prerequisites often reference Windows permissions or tools first. While there are connectors for Linux-centric technologies (e.g., Syslog via AMA), the overall pattern is to present Windows solutions and tools as the default or primary approach, with Linux support being less prominent or omitted.