Document Details
Normalization About Schemas
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
missing_linux_example
Summary
The documentation provides a detailed overview of ASIM schemas and normalization concepts, but the only concrete example given is for Windows event 4624. No equivalent Linux or macOS event normalization example is provided, and the Windows example is presented as the sole mapping illustration. This may create friction for users seeking to normalize Linux/macOS audit or authentication events.
Recommendations
- Add a sample entity mapping and normalization example for a common Linux audit event (e.g., a Linux authentication or process event from syslog or auditd).
- Explicitly mention that ASIM schemas are designed to normalize data from both Windows and non-Windows sources, and provide links or references to Linux/macOS event normalization.
- Where possible, balance Windows and Linux/macOS examples in documentation sections that are not inherently Windows-only.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|