Document Details
Normalization Schema Authentication
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
windows_heavy_examples
missing_linux_example
Summary
The documentation page demonstrates a Windows bias in several ways: Windows is mentioned first and most frequently as an example of authentication event sources, and Windows-specific tools, formats, and terminology (e.g., NTLM, SID, domain\hostname, svchost.exe) are used throughout field examples and descriptions. There are no equivalent Linux or non-Windows examples (e.g., Linux PAM, SSH, systemd, /usr/bin/sshd, UID/GID, etc.), nor are Linux authentication protocols or patterns referenced. This may make the documentation less accessible or relevant to users working in heterogeneous or Linux-dominant environments.
Recommendations
- Add Linux-specific examples alongside Windows ones for fields such as LogonProtocol (e.g., Kerberos, SSH, PAM), LogonMethod (e.g., public key, password, certificate), and application/process names (e.g., /usr/bin/sshd, /usr/sbin/login).
- Include Linux authentication event sources (e.g., Linux servers, firewalls, VPN gateways using OpenVPN or strongSwan) in introductory explanations.
- Reference Linux user and device identifiers (e.g., UID, GID) and hostname/domain formats (e.g., FQDN, /etc/hostname) where appropriate.
- Provide examples of authentication events from Linux systems in KQL queries and field value tables.
- Clarify that the schema is intended to be cross-platform and provide guidance for mapping Linux authentication events to the schema fields.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-21 00:00 | #278 | completed |
 Clean
|
| 2026-01-18 00:00 | #266 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|