Api Dcr Reference - Document Details

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.

View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types

windows_first

missing_linux_example

Summary

The documentation provides examples for creating Data Collection Rules (DCRs) and their associations, with a focus on API requests and JSON payloads. While the Syslog/CEF example explicitly sets 'kind': 'Linux', the custom log example uses a Windows file path ('C:\Server\bin\log\Apache24\logs\*.log') in the response, and does not provide a Linux file path equivalent. There are no PowerShell or Windows tool-specific commands, but the only concrete file path example is Windows-style, and Linux patterns are not shown. This may confuse or exclude Linux users, especially since custom log collection is a common Linux scenario.

Recommendations

For every example using a Windows file path, provide a Linux equivalent (e.g., '/var/log/apache2/*.log').
Explicitly mention both Windows and Linux file path conventions in the documentation.
If the DCRs support both OS types, clarify any OS-specific requirements or differences.
Add a note or table summarizing path syntax differences between platforms.
Ensure that sample payloads and responses are balanced between Windows and Linux scenarios.

Create Pull Request

Scan History

Date	Scan	Status	Result
2026-01-14 00:00	#250	in_progress	Clean
2026-01-13 00:00	#246	completed	Clean
2026-01-11 00:00	#240	completed	Clean
2026-01-10 00:00	#237	completed	Clean
2026-01-09 00:34	#234	completed	Clean
2026-01-08 00:53	#231	completed	Clean
2026-01-06 18:15	#225	cancelled	Clean
2025-08-17 00:01	#83	cancelled	Clean
2025-07-13 21:37	#48	completed	Clean
2025-07-12 23:44	#41	cancelled	Biased

Flagged Code Snippets

{
    "properties": {
        "immutableId": "dcr-00112233445566778899aabbccddeeff",
        "dataCollectionEndpointId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionEndpoints/Microsoft-Sentinel-aaaabbbbccccddddeeeefff",
        "streamDeclarations": {
            "Custom-Text-ApacheHTTPServer_CL": {
                "columns": [
                    {
                        "name": "TimeGenerated",
                        "type": "datetime"
                    },
                    {
                        "name": "RawData",
                        "type": "string"
                    }
                ]
            }
        },
        "dataSources": {
            "logFiles": [
                {
                    "streams": [
                        "Custom-Text-ApacheHTTPServer_CL"
                    ],
                    "filePatterns": [
                        "C:\\Server\\bin\\log\\Apache24\\logs\\*.log"
                    ],
                    "format": "text",
                    "settings": {
                        "text": {
                            "recordStartTimestampFormat": "ISO 8601"
                        }
                    },
                    "name": "Custom-Text-ApacheHTTPServer_CL"
                }
            ]
        },
        "destinations": {
            "logAnalytics": [
                {
                    "workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/contoso-rg-1/providers/Microsoft.OperationalInsights/workspaces/CyberSOC",
                    "workspaceId": "cccccccc-3333-4444-5555-dddddddddddd",
                    "name": "DataCollectionEvent"
                }
            ]
        },
        "dataFlows": [
            {
                "streams": [
                    "Custom-Text-ApacheHTTPServer_CL"
                ],
                "destinations": [
                    "DataCollectionEvent"
                ],
                "transformKql": "source",
                "outputStream": "Custom-ApacheHTTPServer_CL"
            }
        ],
        "provisioningState": "Succeeded"
    },
    "location": "centralus",
    "tags": {
        "createdBy": "Sentinel"
    },
    "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionRules/DCR-CustomLogs-01",
    "name": "DCR-CustomLogs-01",
    "type": "Microsoft.Insights/dataCollectionRules",
    "etag": "\"00000000-1111-2222-3333-444444444444\"",
    "systemData": {
        "createdBy": "gbarnes@contoso.com",
        "createdByType": "User",
        "createdAt": "2024-08-12T09:29:15.1083961Z",
        "lastModifiedBy": "gbarnes@contoso.com",
        "lastModifiedByType": "User",
        "lastModifiedAt": "2024-08-12T09:29:15.1083961Z"
    }
}