Document Details
Cef Name Mapping
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
Summary
The documentation provides mappings between CEF keys and CommonSecurityLog fields in Microsoft Sentinel. While the content is generally platform-neutral, some field descriptions (e.g., filePath, oldFilePath) list Windows-style paths before Linux-style paths, and several fields reference Windows domains (e.g., deviceNtDomain, dntdom, sntdom) without equivalent mention of Linux/macOS concepts. However, the overall mapping is relevant to both Windows and Linux environments, and examples for both are present in some cases.
Recommendations
- When providing example file paths, alternate the order or give Linux/macOS examples first in some cases.
- Where fields reference Windows-specific concepts (e.g., NTDomain), clarify if/how these fields are used for Linux/macOS sources, or mention that they may be empty or not applicable.
- Add more Linux/macOS-centric examples where possible, especially for fields like process names, file paths, and domain concepts.
- Ensure that descriptions do not imply Windows is the default or primary platform unless the feature is Windows-only.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|