Document Details

The documentation page demonstrates a Windows bias primarily through its exclusive use of Azure portal GUI instructions, which are most commonly accessed from Windows environments. The only explicit OS mentioned in the job templates is 'Windows' (e.g., 'Windows suspicious login outside normal hours'), with no equivalent Linux-focused examples or templates. There are no references to Linux tools, shell commands, or CLI alternatives (such as Azure CLI, Bash, or PowerShell cross-platform usage), nor are Linux-specific scenarios or logs (e.g., syslog, auditd) covered. The workflow and screenshots are tailored to the Defender portal and Azure portal, which are typically used in Windows-centric environments.