Document Details
Normalization Schema Alert
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
Summary
The documentation page is generally platform-neutral, focusing on schema definitions and concepts relevant to Microsoft Sentinel and ASIM. However, there is a mild Windows bias in example values and field descriptions, such as file paths (e.g., C:\Windows\explorer.exe), registry keys (e.g., HKEY_LOCAL_MACHINE), and process names, which are all Windows-centric. No Linux/macOS-specific examples or references are provided, and Windows patterns/tools are used as the default illustration.
Recommendations
- Include Linux/macOS examples alongside Windows ones for fields like file paths (e.g., /usr/bin/bash), process names, and registry equivalents (if applicable).
- Add sample values for fields that reflect Linux/macOS environments, such as Linux process paths, Linux user formats, or macOS file locations.
- Where possible, clarify that the schema is applicable to alerts from non-Windows systems and provide guidance or references for mapping Linux/macOS-specific data.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
 Clean
|
| 2026-01-15 00:00 | #254 | completed |
Clean
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Clean
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|