Document Details
Anomalies Reference
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
windows_tools
Summary
The documentation page describes anomaly detection features in Microsoft Sentinel, referencing a variety of data sources including Azure, AWS, GCP, Okta, and Office logs. However, there is a notable bias toward Windows environments: many anomaly types and detection algorithms are based exclusively on Windows Security logs (e.g., event IDs 4624 and 4625), with no mention of equivalent Linux/macOS log sources or examples. The documentation does not provide guidance or parity for Linux/macOS systems, nor does it mention how to enable similar anomaly detection for non-Windows hosts. Windows-specific tools and event patterns are referenced without Linux alternatives.
Recommendations
- Add sections or notes describing how Linux/macOS systems can be monitored for similar anomalies (e.g., using syslog, auditd, or other Linux-native logging sources).
- Provide equivalent Linux/macOS log event IDs or patterns for account creation, deletion, logon, and brute-force attempts.
- Clarify whether Sentinel supports anomaly detection for Linux/macOS hosts and, if so, document the required data connectors and log formats.
- Where Windows Security logs are referenced, add Linux/macOS examples or mention their absence if not supported.
- Consider including cross-platform examples or a table mapping Windows events to Linux/macOS equivalents.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-09-09 00:00 | #106 | completed |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Clean
|