Bias Analysis
Detected Bias Types
windows_first
windows_examples
windows_terms
Summary
The documentation demonstrates a moderate Windows bias. Windows terminology (e.g., domain\hostname format, Windows username type, Windows 10 OS examples) is used preferentially or exclusively in field examples and descriptions. Windows-specific formats are mentioned before or in preference to Linux/Unix equivalents, and examples for fields like hostnames, usernames, and application paths are Windows-centric. There are no explicit Linux or Unix examples, nor are Linux-specific patterns or tools referenced.
Recommendations
- Include Linux/Unix examples alongside Windows examples for fields such as hostnames, usernames, application paths, and OS types (e.g., show 'ubuntu-server', '/usr/bin/sshd', 'root', etc.).
- Mention Linux/Unix formats (e.g., FQDN as 'host.example.com', usernames without domains, application paths like '/usr/bin/bash') equally or before Windows formats where relevant.
- Add references to Linux audit tools and patterns (e.g., auditd, syslog, journald) in relevant sections.
- Clarify that the schema is OS-agnostic and provide guidance for mapping Linux/Unix audit events to the schema.
- Where enumerated types or examples are given (e.g., OS, username type), explicitly list Linux/Unix values alongside Windows values.
Create Pull Request