Document Details

The documentation page demonstrates a significant Windows bias. Most anomaly detection examples and machine learning models are based on Windows Security logs (e.g., Event IDs 4624 and 4625) and Windows-specific account activities. There is frequent mention of Windows tools and patterns (such as PowerShell and Windows Security logs), with no equivalent Linux or Unix log sources (e.g., syslog, auth.log, auditd) or examples. Linux-specific account creation, authentication, or brute force detection scenarios are missing, and there are no references to Linux command interpreters (e.g., Bash, sh) in code execution anomalies. The documentation assumes a Windows-centric environment for local account and authentication anomalies, and does not provide parity for Linux environments.