Document Details
Normalization Schema Authentication
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
windows_examples
Summary
The documentation demonstrates a Windows bias in several ways: Windows is mentioned first and most frequently as an example of authentication event sources, and Windows-specific tools, formats, and terminology (e.g., NTLM, SID, domain\hostname, svchost.exe) are used in field examples and descriptions. Linux or non-Windows equivalents are not provided or are mentioned only generically (e.g., 'firewall', 'VPN gateway'). The schema field examples and explanations predominantly use Windows-centric values and patterns.
Recommendations
- Include Linux and macOS authentication event sources explicitly in introductory sections and examples.
- Provide example field values and patterns for Linux (e.g., UID/GID, /usr/bin/sshd, /var/log/auth.log, PAM, Kerberos) and macOS (e.g., user short name, Apple ID, launchd).
- Mention Linux authentication protocols (e.g., Kerberos, LDAP, PAM) alongside NTLM and Windows-specific protocols.
- Show examples of device and user identifiers as used in Linux (e.g., numeric UID, hostname formats, systemd service names) and macOS.
- Clarify that fields such as domain, hostname, and application name can have different formats on Linux/macOS, and provide those formats as examples.
- Add references to Linux and macOS security event documentation or tools where relevant.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-21 00:00 | #278 | completed |
 Clean
|
| 2026-01-18 00:00 | #266 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|