Skip to content

Commit bb09a61

Browse files
authored
Apply suggestions from code review
1 parent d087822 commit bb09a61

File tree

2 files changed

+7
-2
lines changed

2 files changed

+7
-2
lines changed

articles/sentinel/entities-reference.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ The following section contains a more in-depth look at the full schemas of each
153153
| **NetBiosName** | String | The host name (pre-Windows 2000). |
154154
| **IoTDevice** | Entity ([IoT Device](#iot-device)) | The IoT Device entity (if this host represents an IoT Device). |
155155
| **AzureID** | String | The Azure resource ID of the VM, if known. |
156-
| **OMSAgentID** | String | The agent ID, if the host has an agent installed. |
156+
| **OMSAgentID** | String | The OMS agent ID, if the host has OMS agent installed. |
157157
| **OSFamily** | Enum? | One of the following values: <li>Linux<li>Windows<li>Android<li>IOS<li>Mac |
158158
| **OSVersion** | String | A free-text representation of the operating system.<br>This field is meant to hold specific versions the are more fine-grained than OSFamily, or future values not supported by OSFamily enumeration. |
159159
| **IsDomainJoined** | Bool | Indicates whether this host belongs to a domain. |

articles/sentinel/normalization-schema-dns.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,12 @@ The changes in version 0.1.7 of the schema are:
332332

333333
The goal of normalizing is to ensure that all sources provide consistent telemetry. A source that doesn't provide the required telemetry, such as mandatory schema fields, cannot be normalized. However, sources that typically provide all required telemetry, even if there are some discrepancies, can be normalized. Discrepancies may affect the completeness of query results.
334334

335-
A known discrepancy includes Corelight Zeek, which may not provide the mandatory DnsQuery field. We have observed such behavior in certain cases in which the DNS response code name is `NXDOMAIN`.
335+
The following table lists known discrepancies:
336+
337+
| Source | Discrepancies |
338+
| ------ | ------------- |
339+
| Microsoft DNS Server Collected using the DNS connector and the Log Analytics Agent | The connector doesn't provide the mandatory DnsQuery field for original event ID 264 (Response to a dynamic update). The data is available at the source, but not forwarded by the connector. |
340+
| Corelight Zeek | Corelight Zeek may not provide the mandatory DnsQuery field. We have observed such behavior in certain cases in which the DNS response code name is `NXDOMAIN`. |
336341

337342
## Handling DNS response
338343

0 commit comments

Comments
 (0)