Document Details
Normalization Schema Alert
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
missing_linux_example
Summary
The documentation exhibits subtle Windows bias. Examples and field descriptions frequently use Windows-centric values (e.g., file paths like C:\Windows\System32\notepad.exe, registry keys such as HKEY_LOCAL_MACHINE, and process names like explorer.exe). There are no Linux-specific examples (such as /var/log/syslog, /usr/bin/bash, or Linux-style process/file paths), nor are Linux tools or patterns mentioned. The schema fields and descriptions prioritize Windows terminology and conventions, and do not provide parity for Linux or cross-platform scenarios.
Recommendations
- Add Linux-specific examples alongside Windows examples for fields such as FilePath, ProcessName, RegistryKey, etc. (e.g., /etc/passwd, /usr/bin/sshd, /var/log/auth.log).
- Include references to Linux equivalents for Windows concepts (e.g., registry vs. configuration files, Windows SID vs. Linux UID/GID).
- Ensure field descriptions and sample values are platform-neutral or provide both Windows and Linux variants.
- Mention Linux security tools and detection methods (e.g., auditd, syslog, SELinux, AppArmor) where relevant.
- Clarify that the schema is intended for cross-platform use and provide guidance/examples for mapping Linux-originating alerts.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
 Clean
|
| 2026-01-15 00:00 | #254 | completed |
Clean
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Clean
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|