Document Details
Normalization Schema Alert
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
missing_linux_example
Summary
The documentation page exhibits subtle Windows bias. Examples for fields such as ProcessName, FilePath, and RegistryKey use Windows-style paths and conventions (e.g., C:\Windows\explorer.exe, HKEY_LOCAL_MACHINE), and references to Windows-specific concepts (SID, Windows usernames) appear before or without Linux equivalents. No Linux or cross-platform examples (e.g., Linux process paths, Linux registry equivalents, Linux user formats) are provided, and Windows tools (e.g., PSEXEC) are mentioned as rule examples. There are no PowerShell-specific examples, but the overall schema and examples are Windows-centric.
Recommendations
- Include Linux-specific examples for fields such as ProcessName (e.g., /usr/bin/sshd), FilePath (e.g., /etc/passwd), and RegistryKey (or note Linux does not have a registry).
- Add user examples using Linux formats (e.g., user@hostname, UID/GID) alongside Windows formats.
- Mention Linux tools (e.g., SSH, sudo, systemd) in rule and threat examples, not just Windows tools like PSEXEC.
- Clarify that the schema is intended for cross-platform use and provide guidance for mapping Linux/macOS fields.
- Where fields are Windows-specific (e.g., SID, RegistryKey), explicitly note their applicability and suggest Linux/macOS alternatives or indicate when fields are not relevant.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
 Clean
|
| 2026-01-15 00:00 | #254 | completed |
Clean
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Clean
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|