Document Details
Normalization About Schemas
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
Summary
The documentation page demonstrates Windows bias by exclusively providing a Windows event (event 4624) as the sole example of entity mapping and normalization. No equivalent Linux or cross-platform event examples (such as Linux audit logs or syslog events) are given. The terminology and sample mappings focus on Windows-specific fields and patterns, and Windows event documentation is referenced directly. This may make it harder for Linux-focused users to understand how ASIM schemas apply to their data sources.
Recommendations
- Add equivalent Linux event normalization examples, such as mapping a Linux authentication event (e.g., /var/log/auth.log or auditd events) to ASIM fields.
- Include references to Linux event documentation and field structures alongside Windows examples.
- Present cross-platform examples (Windows, Linux, and possibly macOS) in parallel to demonstrate schema applicability and parity.
- Clarify that ASIM schemas are designed for normalization across all platforms, not just Windows.
- Where possible, use generic terminology or provide mappings for both Windows and Linux field names.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|