Document Details
Anomalies Reference
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
missing_linux_example
powershell_heavy
Summary
The documentation page shows a notable Windows bias: anomaly detections and examples frequently reference Windows-specific logs (Windows Security logs, Event IDs 4624/4625), and PowerShell is mentioned as a sub-technique. There is a lack of parity for Linux/macOS environments—no Linux audit log, syslog, or equivalent examples are provided, and anomaly detection descriptions focus on Windows authentication and account events. Linux tools, log formats, and detection patterns are not discussed, making it unclear how Linux/macOS users can leverage these features.
Recommendations
- Add equivalent Linux/macOS anomaly detection examples, referencing common log sources such as syslog, auditd, journald, or SSH authentication logs.
- Include Linux-specific MITRE ATT&CK sub-techniques and activities (e.g., bash, sh, sudo, SSH brute force) alongside PowerShell.
- Clarify which anomaly detections are supported for Linux/macOS endpoints and how to configure data ingestion from those platforms.
- Provide sample queries or detection rules for Linux/macOS authentication and account manipulation events.
- Reorder examples so that cross-platform or Linux/macOS scenarios are presented alongside or before Windows-specific ones where possible.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-09-09 00:00 | #106 | completed |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Clean
|