Bias Analysis
Detected Bias Types
windows_tools
windows_first
windows_examples
Summary
The documentation page exhibits mild Windows bias. Several example values and field names reference Windows-centric concepts, such as file paths (C:\Malicious\ImNotMalicious.exe), file extensions (.exe), user domains (WORKGROUP, DESKTOP), and device types (Ethernet adapter, Microsoft Hyper-V Network Adapter). The HTTP user agent example includes 'Windows NT 10.0', and user IDs reference SIDs, which are Windows-specific. There is little mention of Linux/Unix equivalents or diversity in examples, and Windows terminology appears first or exclusively in several places.
Recommendations
- Include Linux/Unix-centric examples alongside Windows ones, such as file paths (/var/log/malicious.sh), file extensions (.sh, .elf), and device names (eth0, wlan0).
- Provide examples of user domains and IDs relevant to Linux/Unix (e.g., UID, GID, local groups) in addition to Windows SIDs and domains.
- Balance references to Windows tools (e.g., Hyper-V, Ethernet adapter) with Linux/Unix equivalents (e.g., KVM, veth, tun/tap).
- Ensure that examples and terminology are platform-neutral or alternate between Windows and Linux/Unix, rather than defaulting to Windows-first.
- Clarify that the schema is intended for cross-platform use and explicitly mention support for Linux/Unix devices and logs.
Create Pull Request