Document Details

The documentation page demonstrates a Windows bias in several ways: anomaly detection examples and algorithms are heavily focused on Windows Security logs (with repeated references to Windows event IDs such as 4624 and 4625), and there is no mention of equivalent Linux audit logs or syslog sources for similar anomaly types. Windows-specific terminology and tools (such as PowerShell in MITRE sub-techniques, Windows Security logs, and event IDs) are used throughout, while Linux equivalents (e.g., auditd, /var/log/auth.log, journald) are absent. This creates a perception that anomaly detection is primarily for Windows environments, with limited guidance for Linux users.