admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'github_detections' of github.com:splunk/security_content into github_detections

Browse Source
This commit is contained in:
P4T12ICK
2021-09-01 13:56:42 +02:00
parent dcbc0f95ad aa834d87ba
commit 2d32848b55
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/github_dependabot_alert.yml
+5 -6
View File
@@ -6,12 +6,11 @@ author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search looks for Dependabot Alerts in Github logs.
search: '`github` alert.id=* action=create
| rename repository.full_name as repository, repository.html_url as repository_url
| stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name
alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in
alert.severity repository repository_url
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
alert.external_identifier alert.external_reference alert.fixed_in alert.severity
repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_dependabot_alert_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.