Normalization Schema Alert - Document Details

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.

View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types

windows_first

windows_tools

missing_linux_example

Summary

The documentation page exhibits a subtle Windows bias. Examples and field descriptions frequently reference Windows-specific concepts (e.g., C:\Windows paths, explorer.exe, registry keys, SID, Windows username format, and tools like PSEXEC and Rubeus). There are no Linux-specific examples (such as Linux file paths, processes, or user formats), and Windows terminology is used as the default or only illustration. Linux equivalents are not mentioned or are missing entirely.

Recommendations

Add Linux-specific examples alongside Windows ones, such as Linux file paths (/usr/bin/sshd), processes (sshd, bash), and user formats (e.g., user@hostname, UID).
Include registry-like configuration examples for Linux (e.g., /etc/passwd, /etc/ssh/sshd_config) in relevant sections.
Mention Linux tools or detection patterns (e.g., SSH brute force, sudo misuse, cron jobs) in rule and threat examples.
Clarify that fields and schema are OS-agnostic, and provide guidance for mapping Linux alerts and entities.
Balance references to Windows-specific concepts (SID, registry, PSEXEC) with Linux equivalents (UID/GID, configuration files, SSH, systemd, etc.).

Create Pull Request

Scan History

Date	Scan	Status	Result
2026-01-22 01:38	#286	completed	Clean
2026-01-15 00:00	#254	completed	Clean
2026-01-14 00:00	#250	in_progress	Biased
2026-01-13 00:00	#246	completed	Clean
2026-01-11 00:00	#240	completed	Biased
2026-01-10 00:00	#237	completed	Biased
2026-01-09 00:34	#234	completed	Biased
2026-01-08 00:53	#231	completed	Biased
2026-01-06 18:15	#225	cancelled	Clean
2025-08-17 00:01	#83	cancelled	Clean
2025-07-13 21:37	#48	completed	Biased
2025-07-12 23:44	#41	cancelled	Biased