Document Details
Ueba Reference
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_tools
Summary
The documentation references Windows Security Events as a primary data source and lists Windows-specific event codes and log tables before mentioning other platforms. Device-related enrichments and examples (e.g., DeviceFamily, OperatingSystem) use Windows as the sample value, with no mention of Linux or macOS equivalents. There are no Linux/macOS-specific log sources, event codes, or enrichment examples provided, and Windows terminology is used in several schema fields (e.g., SID, local admin). However, the documentation does include cloud and third-party sources (AWS, GCP, Okta), which broadens its scope beyond Windows.
Recommendations
- Add examples of Linux/macOS device logon events and how they are ingested/analyzed by UEBA, if supported.
- Include sample enrichment values for non-Windows operating systems (e.g., Linux, macOS) in tables and examples.
- Clarify whether Linux/macOS security events are supported as UEBA data sources and, if so, provide equivalent event codes and log table references.
- If Windows is the only supported OS for certain features, explicitly state this to avoid confusion.
- Consider including a section on cross-platform support and limitations for UEBA data sources and enrichments.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
 Clean
|
| 2025-09-16 00:00 | #113 | completed |
Clean
|
| 2025-09-15 00:00 | #112 | completed |
Clean
|
| 2025-09-14 00:00 | #111 | completed |
Clean
|
| 2025-09-13 00:00 | #110 | completed |
Clean
|
| 2025-09-12 00:00 | #109 | completed |
Clean
|
| 2025-09-11 00:00 | #108 | completed |
Clean
|
| 2025-09-10 00:00 | #107 | completed |
Clean
|
| 2025-09-09 00:00 | #106 | completed |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|