Document Details
Normalization Schema Authentication
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
windows_examples
windows_terms
Summary
The documentation references Windows authentication events and Windows-specific terms (e.g., NTLM, SID, domain\hostname format) more frequently and provides Windows-centric examples (such as C:\Windows\System32\svchost.exe, domain\hostname, and 'Windows 10' OS values). Windows is mentioned first when discussing operating systems and authentication sources, and examples often use Windows conventions. However, the schema itself is designed to be cross-platform and references non-Windows systems (e.g., AWS, SaaS apps, PKI, Service Principal), and does not exclude Linux/macOS. There are no PowerShell-only instructions or Windows-only tooling.
Recommendations
- Add Linux/macOS-centric examples alongside Windows ones (e.g., show authentication events from Linux systems, use Linux process paths like /usr/bin/sshd, Linux user naming conventions, and Linux OS values).
- When describing fields such as FQDN, clarify Linux/macOS formats and provide examples (e.g., 'host.example.com').
- Include references to Linux/macOS authentication protocols (e.g., Kerberos, LDAP, PAM) in the LogonProtocol field.
- Balance introductory statements to mention Linux/macOS equally with Windows when discussing authentication event sources.
- Where possible, provide examples of authentication events from non-Windows devices (e.g., firewalls, VPNs running on Linux, macOS endpoints).
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-22 01:38 | #286 | completed |
Biased
|
| 2026-01-21 00:00 | #278 | completed |
 Clean
|
| 2026-01-18 00:00 | #266 | completed |
Biased
|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
Biased
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Clean
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|