Bias Analysis
Detected Bias Types
windows_first
windows_tools
powershell_heavy
missing_linux_example
Summary
The documentation exhibits a Windows bias in several ways: Windows-specific concepts (NTDomain, NetBiosName, SID, RegistryKey/Hive, WindowsSecurityZoneType) are consistently mentioned and defined, often before or instead of Linux equivalents. Many identifiers and schema fields reference Windows-centric technologies (Active Directory, NTFS, Windows Registry, Windows Security Zones) with no mention of Linux alternatives (e.g., Linux user/group IDs, /etc/passwd, Linux file attributes, Linux process details). The OSFamily enum lists Linux, but no Linux-specific fields or examples are provided. There are no Linux-specific identifier patterns, and examples are almost exclusively Windows-oriented.
Recommendations
- Add Linux-specific identifiers and examples for Account, Host, File, and Process entities (e.g., UID/GID, /etc/passwd, /etc/group, Linux file paths, Linux process attributes).
- Include Linux registry/file system equivalents or clarify how Linux systems are represented (e.g., mention that RegistryKey/Hive is Windows-only, and describe Linux configuration file mapping).
- Provide Linux-centric examples alongside Windows ones, such as Linux domain names, hostnames, and process details.
- Clarify in each schema field which identifiers are Windows-specific and which are applicable to Linux, and add Linux-specific documentation where possible.
- Expand the OSFamily and OSVersion sections to provide Linux-specific details and examples, such as common distributions and versioning schemes.
- Where Windows tools or concepts are referenced (e.g., NTFS, Active Directory, WindowsSecurityZoneType), provide Linux alternatives or note their absence.
Create Pull Request