From 9354dad823694ee2ccc960ce6d7fbb04efbda5af Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 4 Apr 2022 13:23:37 +0200 Subject: [PATCH] improved GitHub detection --- detections/cloud/github_commit_changes_in_master.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index f21eb4c802..940cf9f3a0 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -10,11 +10,11 @@ description: This search is to detect a pushed or commit to master or main branc Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch -search: '`github` branches{}.name = main OR branches{}.name = master | eval severity="low" - | eval phase="code" | stats count min(_time) as firstTime max(_time) as lastTime by - commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message - repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code" - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`' +search: '`github` branches{}.name = main OR branches{}.name = master + | stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message + repository.pushed_at commit.commit.committer.date repository.full_name + | rename commit.author.login as user, repository.full_name as repository + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.