Document Details
Normalization About Schemas
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
Summary
The documentation page demonstrates Windows bias by exclusively using Windows event 4624 as the sole example of entity mapping and normalization, with no equivalent Linux or cross-platform event log examples. Windows terminology and event fields are mapped first and exclusively, while Linux audit logs or syslog sources are not mentioned or exemplified.
Recommendations
- Add equivalent Linux event normalization examples, such as mapping fields from Linux auditd or syslog events to ASIM schemas.
- Include cross-platform sample mappings (e.g., SSH authentication events, Linux process events) alongside Windows examples.
- Reference Linux tools and event sources (auditd, journald, syslog) in schema field mapping discussions.
- Ensure that introductory and sample sections do not prioritize Windows events or terminology over Linux or other platforms.
- Provide links to documentation or resources for Linux event normalization in Microsoft Sentinel.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|