Document Details

The documentation provides both Windows and Linux guidance for data collection in Microsoft Sentinel, but Windows-specific tools and patterns (such as Windows Event Forwarding, PowerShell, and Windows-centric agent configuration) are frequently mentioned first or exclusively in several sections. Some examples and solutions for Windows (e.g., PowerShell, Windows Event Forwarding) are more detailed or appear before Linux equivalents, and endpoint log collection mentions Windows Event Forwarding but omits Linux endpoint examples. However, Linux solutions are present and described in parallel tables, and most tasks are achievable on both platforms.