Document Details
Normalization Schema Authentication
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
missing_linux_example
Summary
The documentation demonstrates a Windows bias by referencing Windows authentication events first, providing examples and field values that are Windows-centric (e.g., NTLM, SID, Windows domain\hostname format, svchost.exe), and omitting equivalent Linux authentication examples, protocols, or tools. Linux authentication mechanisms and field values (such as PAM, SSH, UIDs, Linux process names) are not mentioned or exemplified, and Windows terminology is used as the default in several places.
Recommendations
- Include Linux authentication event examples (e.g., SSH logins, PAM events, Linux process names) alongside or before Windows examples.
- Mention Linux authentication protocols (e.g., Kerberos, SSH, PAM) and provide sample values for fields like LogonProtocol and LogonMethod relevant to Linux.
- Add Linux-specific field value examples (e.g., UID for ActorUserId, /usr/bin/sshd for ActingAppName, Linux hostname formats) in relevant tables.
- Clarify that fields such as UsernameType, UserIdType, and AppType can have Linux-specific values, and provide those values in documentation.
- Ensure that references to domain/hostname formats acknowledge Linux conventions (e.g., FQDN, /etc/hostname) and not just Windows domain\hostname.
- Balance introductory statements to mention Linux and other OS authentication events equally with Windows.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-21 00:00 | #278 | completed |
 Clean
|
| 2026-01-18 00:00 | #266 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|