From aa834d87ba199d1f051aa09980024c6e72dab992 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 1 Sep 2021 09:49:38 +0000 Subject: [PATCH] Added detection testing service results inGitHub Dependabot Alert --- detections/cloud/github_dependabot_alert.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index f30cfa4c01..7a2bdc59b3 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -6,12 +6,11 @@ author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] description: This search looks for Dependabot Alerts in Github logs. -search: '`github` alert.id=* action=create - | rename repository.full_name as repository, repository.html_url as repository_url - | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name - alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in - alert.severity repository repository_url - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`github` alert.id=* action=create | rename repository.full_name as repository, + repository.html_url as repository_url | stats min(_time) as firstTime max(_time) + as lastTime by action alert.affected_package_name alert.affected_range alert.created_at + alert.external_identifier alert.external_reference alert.fixed_in alert.severity + repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`' how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.