Sentinel
391
Total Pages
285
Linux-Friendly Pages
106
Pages with Bias
27.1%
Bias Rate
Bias Trend Over Time
Pages with Bias Issues
488 issues found
Showing 476-488 of 488 flagged pages
Sentinel
The Advanced Security Information Model (ASIM) File Event normalization schema reference| Microsoft Docs
...n/articles/sentinel/normalization-schema-file-event.md
Low Priority
View Details →
Detected Bias Types
Windows First
Windows Tools
Minor Windows Examples
Summary
The documentation demonstrates a mild Windows bias. Windows terminology and examples (e.g., 'Windows File Explorer', 'C:\Windows\System32\notepad.exe') are presented first or exclusively in several places, and Windows-specific formats and fields are described in detail. However, Linux/Unix equivalents are also mentioned, and the schema is designed to be cross-platform, with explicit support for Unix paths and examples (e.g., '/etc/init.d/networking'). There are no critical sections that are Windows-only, and Linux/macOS users can complete all tasks, but the overall framing and examples lean toward Windows.
Recommendations
- Balance examples by providing Linux/macOS equivalents alongside Windows ones, especially in introductory sections.
- When describing fields or formats, present Unix/Linux and Windows options in parallel rather than listing Windows first.
- Include more Linux/macOS-specific process/application examples (e.g., 'nautilus', '/usr/bin/vim') where Windows tools are referenced.
- Clarify that all schema fields and normalization patterns are intended for cross-platform use, and highlight any platform-specific caveats.
- Consider adding a table or section explicitly mapping common Windows and Linux/macOS file operations and paths.
Create Pull Request
Sentinel
The Advanced Security Information Model (ASIM) DNS normalization schema reference | Microsoft Docs
...lob/main/articles/sentinel/normalization-schema-dns.md
Low Priority
View Details →
Detected Bias Types
Windows First
Windows Tools
Windows Examples
Summary
The documentation demonstrates a mild Windows bias. Windows terminology (e.g., domain\hostname, SIDs, C:\Windows paths) is used in examples and field descriptions, often before or instead of Linux/macOS equivalents. Hostname and domain examples use Windows formats, and process examples reference Windows paths. There is mention of Linux in one place (process IDs), but no Linux/macOS-specific examples, formats, or terminology are provided.
Recommendations
- Add Linux/macOS-specific examples for fields like SrcHostname, SrcProcessName, and process IDs (e.g., /usr/bin/sshd, /var/log, UID/GID formats).
- Include Linux/macOS domain and user formats (e.g., FQDNs, POSIX usernames, UIDs) alongside Windows examples.
- Clarify that fields and formats are source-agnostic and provide explicit guidance for mapping Linux/macOS telemetry to the schema.
- Balance example hostnames, process paths, and user identifiers between Windows and Linux/macOS.
- Reference Linux/macOS DNS server sources (e.g., BIND, Unbound, dnsmasq) in the discrepancies and source sections.
Sentinel
Connect your SAP system to Microsoft Sentinel | Microsoft Sentinel
.../sentinel/sap/deploy-data-connector-agent-container.md
Low Priority
View Details →
Detected Bias Types
Windows First
Missing Linux Example
Summary
The documentation page demonstrates a mild Windows bias by referencing Azure portal and command-line tools (Azure CLI) without explicit mention of Linux or macOS alternatives. However, most examples use Azure CLI commands, which are cross-platform, and VM creation examples use Ubuntu images. There are no explicit Windows/Powershell-only instructions, but the documentation assumes familiarity with Azure tools and does not provide Linux/macOS-specific troubleshooting or alternative workflows. The order of presentation (portal first, then command line) may imply a Windows-centric workflow, but the actual technical steps are generally platform-neutral.
Recommendations
- Explicitly state that all Azure CLI commands work on Linux, macOS, and Windows, and provide links to installation guides for each OS.
- Add troubleshooting notes or tips for Linux/macOS users, such as permissions, package installation, or differences in shell environments.
- Include example screenshots or terminal outputs from Linux/macOS environments to reinforce cross-platform support.
- Clarify that the portal and command-line workflows are OS-agnostic, and mention any OS-specific caveats if they exist.
- If Powershell is supported, provide equivalent Bash and Powershell examples side-by-side.
Sentinel
Sample Microsoft Sentinel workspace designs
...lob/main/articles/sentinel/sample-workspace-designs.md
Low Priority
View Details →
Detected Bias Types
Windows First
Missing Linux Example
Summary
The documentation page demonstrates a mild Windows bias by consistently listing 'Windows Security Events' and 'Windows Events' as primary log sources, and by referencing the Azure Monitoring Agent (AMA) specifically for Windows VM log collection. There are no explicit Linux log collection examples, nor are Linux-specific tools or patterns mentioned. Syslog and CEF are referenced generically, but without detail or parity to the Windows-specific guidance. No PowerShell or Windows-only tools are mentioned, but the examples and recommendations implicitly prioritize Windows environments.
Recommendations
- Add explicit examples and guidance for collecting Linux security and audit logs (e.g., syslog, auditd) from Linux VMs, both on-premises and in Azure.
- Mention Linux-specific agent configuration (e.g., AMA for Linux, or legacy OMS agent) and clarify any differences in setup or capabilities.
- Provide parity in log source lists by including Linux equivalents alongside Windows (e.g., 'Windows Security Events and Linux syslog/audit logs').
- Reference Linux diagnostic settings and access control patterns where applicable.
- If table-level RBAC or workspace design considerations differ for Linux, call these out.
Sentinel
Scheduled analytics rules in Microsoft Sentinel | Microsoft Docs
...lob/main/articles/sentinel/scheduled-rules-overview.md
Low Priority
View Details →
Detected Bias Types
Windows First
Powershell Heavy
Missing Linux Example
Summary
The documentation page for scheduled analytics rules in Microsoft Sentinel demonstrates a mild Windows bias. In the 'Next steps' section, automation of rule enablement is described via API and PowerShell, with PowerShell explicitly referenced and linked before any mention of Linux-compatible alternatives. There are no Linux shell (bash/CLI) examples or references to cross-platform tools like Azure CLI, and PowerShell is presented as the default scripting method for automation. No explicit Windows-only tools are mentioned, but the lack of Linux/macOS parity in examples and tool references may create friction for non-Windows users.
Recommendations
- Add Azure CLI examples and references alongside PowerShell for automation tasks, as Azure CLI is cross-platform and widely used on Linux/macOS.
- Explicitly mention that PowerShell Core is available on Linux/macOS, or provide bash scripting examples where appropriate.
- Ensure that automation instructions do not assume a Windows environment; clarify which steps are platform-agnostic.
- Where possible, provide parity in code samples and tool recommendations for Linux/macOS users.
Sentinel
Create Hunting Queries for Microsoft Sentinel Solutions
...n/articles/sentinel/sentinel-hunting-rules-creation.md
Low Priority
View Details →
Detected Bias Types
Windows Tools
Windows First
Summary
The documentation page exhibits mild Windows bias by explicitly mentioning PowerShell's New-GUID cmdlet as a way to generate GUIDs, without listing Linux/macOS alternatives. The PowerShell method is described first and in detail, while other options are referenced generically ('any development tool, an online generator'), with no concrete Linux or cross-platform examples. No other sections show platform bias; all technical content is platform-neutral.
Recommendations
- List Linux/macOS command-line alternatives for GUID generation, such as 'uuidgen' (Linux/macOS) or 'cat /proc/sys/kernel/random/uuid'.
- Provide example commands for GUID generation on multiple platforms (Windows, Linux, macOS) side-by-side.
- Avoid mentioning Windows tools first; present platform-neutral or cross-platform options before platform-specific ones.
- Consider linking to cross-platform online GUID generators or libraries.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/business-applications/solution-overview.md
...es/sentinel/business-applications/solution-overview.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation does not display overt Windows bias in terms of command-line examples, tools, or patterns, but it lacks any mention of Linux or cross-platform considerations. There are no examples or instructions that reference Windows-specific tools (like PowerShell) or workflows, but equally, there is no information about Linux compatibility, deployment, or usage, which may leave Linux users uncertain about support or required steps.
Recommendations
- Explicitly state whether the Microsoft Sentinel solution for MS Business Apps is supported on both Windows and Linux environments.
- If relevant, provide examples or notes for both Windows and Linux administrators (e.g., how to configure connectors or access logs from Linux-based systems).
- Mention any platform-specific requirements, limitations, or best practices for Linux environments.
- Include references or links to cross-platform documentation or troubleshooting guides.
- Clarify if any features (such as Playbooks or Parsers) have different behaviors or setup steps on Linux versus Windows.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/connect-threat-intelligence-taxii.md
...articles/sentinel/connect-threat-intelligence-taxii.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation does not display overt Windows bias in terms of command-line examples or tool recommendations. However, it lacks parity by not providing any Linux-specific examples or instructions, especially in the section where cURL is mentioned. The only command-line tool referenced (cURL) is cross-platform, but no explicit Linux or macOS usage is shown, nor are there any screenshots or steps that acknowledge Linux environments. The documentation is focused on the Microsoft Sentinel web interface, which is platform-agnostic, but it misses opportunities to address Linux users directly.
Recommendations
- When mentioning cURL, provide explicit examples for both Windows (e.g., PowerShell or Command Prompt) and Linux/macOS (e.g., bash shell).
- Include notes or sections that clarify that all steps can be performed from any OS with a supported browser, and highlight any OS-specific considerations if they exist.
- If screenshots or instructions reference file paths or command-line usage, ensure both Windows and Linux formats are shown.
- Consider adding a brief section or FAQ addressing common Linux/macOS user questions, such as authentication or network troubleshooting.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/migration-qradar-automation.md
.../main/articles/sentinel/migration-qradar-automation.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation page does not display overt Windows bias in terms of mentioning Windows tools, PowerShell, or Windows-specific patterns. However, it lacks any mention of Linux-specific tools, workflows, or examples, and does not address cross-platform considerations. All examples and instructions are platform-neutral but implicitly assume the use of Azure Logic Apps and Microsoft Sentinel interfaces, which are web-based and not OS-specific. The absence of Linux-specific guidance or parity checks constitutes a 'missing_linux_example' bias.
Recommendations
- Explicitly mention that Microsoft Sentinel and Logic Apps are accessible and manageable from Linux, macOS, and Windows environments.
- Provide example workflows or command-line interactions (e.g., using Azure CLI) from a Linux shell, especially for tasks like exporting/importing ARM templates or managing playbooks.
- Include references to cross-platform tools (such as Azure CLI, REST API usage) and clarify that PowerShell is not required.
- Add a section or note on how to perform common migration or operational tasks from Linux systems, ensuring parity with any Windows-based instructions.
- If any automation or scripting is discussed, provide both Bash and PowerShell examples where relevant.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/siem-migration.md
...ure-docs/blob/main/articles/sentinel/siem-migration.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation page focuses exclusively on Splunk-to-Microsoft Sentinel migration and provides step-by-step instructions for exporting data from Splunk using Splunk Web, but does not mention or provide examples for Linux command-line tools, shell scripts, or non-GUI workflows. There are no references to Windows-specific tools or PowerShell, but the lack of Linux/CLI parity in the export/upload process and absence of cross-platform considerations indicate a subtle bias toward GUI-based (often Windows-centric) workflows.
Recommendations
- Add instructions for exporting Splunk detections using the Splunk CLI or REST API, with example commands for Linux environments.
- Include sample shell scripts or curl commands for users who prefer or require command-line workflows, especially on Linux systems.
- Clarify that the export and upload process can be performed from any OS, and provide OS-agnostic guidance.
- Where screenshots are shown, consider including both GUI and CLI alternatives, or at least mention that CLI options exist.
- Explicitly state platform requirements or lack thereof, to reassure Linux users that the process is not Windows-specific.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/hunting-with-rest-api.md
...s/blob/main/articles/sentinel/hunting-with-rest-api.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation provides only HTTP REST API examples and does not include any platform-specific command-line examples (such as PowerShell, curl, or CLI). However, it also does not provide any Linux-specific guidance or examples (e.g., using curl or bash), which may disadvantage Linux users who are accustomed to such tools. There is no explicit Windows bias in the form of PowerShell or Windows tool references, but the lack of Linux-oriented examples is a subtle bias.
Recommendations
- Add example commands using curl for Linux/macOS users to demonstrate how to make the REST API calls from a Linux shell.
- If providing command-line examples, ensure parity by including both PowerShell (for Windows) and bash/curl (for Linux/macOS) examples.
- Explicitly mention that the REST API can be accessed from any platform and provide guidance or links for common tools on both Windows and Linux.
- Consider including sample scripts or one-liners for both Windows and Linux environments to illustrate cross-platform usage.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/dynamics-365/deploy-dynamics-365-finance-operations-solution.md
...365/deploy-dynamics-365-finance-operations-solution.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation does not display overt Windows bias in terms of mentioning Windows-specific tools, PowerShell, or Windows-first ordering. However, it is implicitly biased toward web-based and Microsoft portal workflows, with no mention of Linux or cross-platform command-line alternatives. There are no examples or instructions for Linux users, such as using Azure CLI, REST APIs, or other non-GUI methods, which may be preferred or required in Linux environments.
Recommendations
- Add equivalent instructions for deploying and configuring the solution using Azure CLI and/or REST API, which are cross-platform and commonly used in Linux environments.
- Where possible, provide command-line examples (e.g., for app registration, secret creation, or data connector configuration) alongside portal-based instructions.
- Explicitly state that all steps can be performed from any OS with a supported browser, or clarify any OS-specific requirements.
- Include troubleshooting or verification steps that use cross-platform tools (e.g., Azure CLI, Kusto Query Language via CLI) rather than only GUI screenshots.
- If any step requires a Windows-only tool or interface, note this clearly and suggest alternatives for Linux users.
Sentinel
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/siem-migration.md
...ure-docs/blob/main/articles/sentinel/siem-migration.md
Low Priority
View Details →
Detected Bias Types
Missing Linux Example
Summary
The documentation page focuses exclusively on migrating from Splunk to Microsoft Sentinel, with all examples and instructions referencing Splunk Web and Microsoft Sentinel in the Azure/Defender portal. There is no mention of operating system-specific tools, but the only example for exporting Splunk detections uses the Splunk Web UI and SPL queries, without any CLI or OS-specific alternatives. No PowerShell, Windows tools, or Windows-first patterns are present, but there is also no mention of Linux command-line options or parity for Linux-based Splunk deployments.
Recommendations
- Provide alternative instructions for exporting Splunk detections using the Splunk CLI, which is commonly used on Linux servers.
- Explicitly state that the migration process is OS-agnostic if that is the case, or clarify any OS-specific requirements.
- Include examples or notes for users managing Splunk on Linux systems, such as using shell scripts or Linux file paths for exports.
- If any step requires access to files or directories, provide both Windows and Linux path examples.