Document Details
Normalization Schema Dns
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
windows_examples
windows-centric_field_values
Summary
The documentation exhibits a Windows bias in several areas: Windows domain and hostname formats are mentioned first and in detail, field examples and value types (such as process names, hostnames, and domain types) use Windows-centric formats, and Windows-specific terminology (e.g., 'Primary Domain Controller', 'Contoso\DESKTOP-1282V4D', 'Windows' domain type) is prevalent. Linux equivalents or examples (e.g., Linux process paths, Linux host/domain formats) are missing or only referenced generically. The documentation does mention Linux in passing (e.g., process ID types), but does not provide parity in examples, terminology, or guidance.
Recommendations
- Add Linux-specific examples for fields such as SrcProcessName (e.g., '/usr/bin/sshd'), SrcHostname (e.g., 'webserver01'), and domain types (e.g., FQDNs typical in Linux environments).
- When listing possible values for fields like SrcDomainType and DstDomainType, mention FQDN first or equally with Windows domain formats.
- Provide process ID conversion examples for Linux (e.g., handling hexadecimal PIDs from Linux audit logs).
- Include Linux-specific device types and terminology in field descriptions and examples (e.g., reference 'systemd', 'init', or Linux service names).
- Ensure that documentation for custom parsers and normalization includes Linux-based DNS servers (e.g., BIND, Unbound) and their logging patterns.
- Balance references to Windows tools and concepts with Linux equivalents throughout the schema and usage notes.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
 Clean
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Clean
|