Document Details
Normalization Schema Authentication
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
Summary
The documentation references Windows as an example OS in several places (e.g., 'Windows sends several authentication events'), and field examples often use Windows-centric formats (such as domain\hostname, SIDs, and Windows process paths). Windows terminology (NTLM, SID, svchost.exe, domain\hostname) is used preferentially or exclusively in examples, with Linux/macOS equivalents not mentioned. However, the schema itself is designed to be cross-platform and references generic concepts (e.g., 'domain controllers', 'VPN gateways', 'firewall'), and does not appear to exclude Linux/macOS systems from use.
Recommendations
- Add Linux/macOS-specific examples alongside Windows examples (e.g., show Linux usernames, process paths, authentication protocols like Kerberos, SSH, or PAM).
- When describing fields such as Hostname, Username, or OS, include Linux/macOS formats and values (e.g., /usr/bin/sshd, UID/GID, user@domain, etc.).
- Clarify that the schema supports authentication events from non-Windows systems and provide explicit guidance or references for integrating Linux/macOS sources.
- In field descriptions, mention Linux/macOS equivalents for Windows-centric terms (e.g., mention Kerberos alongside NTLM, or Linux UIDs alongside SIDs).
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-21 00:00 | #278 | completed |
 Clean
|
| 2026-01-18 00:00 | #266 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|