Document Details
Normalization About Schemas
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
Summary
The documentation provides a detailed overview of ASIM schemas but demonstrates Windows bias by exclusively using a Windows event (event 4624) as the sole example of entity mapping and normalization. No equivalent Linux or cross-platform event normalization examples are provided, and Windows terminology and field names are referenced without Linux parity.
Recommendations
- Add equivalent Linux audit event examples (e.g., from /var/log/auth.log or auditd) to demonstrate normalization for non-Windows sources.
- Include cross-platform normalization tables showing both Windows and Linux field mappings to ASIM schema fields.
- Reference Linux-specific terminology and field names alongside Windows examples to ensure parity.
- Ensure future documentation sections alternate or balance Windows and Linux examples when describing normalization processes.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|