admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inGithub Commit Changes In Master

Browse Source
This commit is contained in:
root
2021-08-27 11:49:55 +00:00
parent 7e87678706
commit 4cd7b43ed0
1 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/github_commit_changes_in_master.yml
+13 -13
View File
@@ -5,16 +5,18 @@ date: '2021-08-20'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel: []
description: This search is to detect a pushed or commit to master or main branch.
This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a
PR for review. of course in some cases admin of the project may did a changes directly to master branch
search: '`github` branches{}.name = main
| stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `github_commit_changes_in_master_filter`'
description: This search is to detect a pushed or commit to master or main branch.
This is to avoid unwanted modification to master without a review to the changes.
Ideally in terms of devsecops the changes made in a branch and do a PR for review.
of course in some cases admin of the project may did a changes directly to master
branch
search: '`github` branches{}.name = main | stats count min(_time) as firstTime max(_time)
as lastTime by commit.author.html_url commit.commit.author.email commit.author.login
commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
logs related to github logs having the fork, commit, push metadata that can be use
to monitor the changes in a github project.
known_false_positives: admin can do changes directly to master branch
references:
- https://www.redhat.com/en/topics/devops/what-is-devsecops
@@ -35,8 +37,7 @@ tags:
- _time
security_domain: endpoint
impact: 30
confidence: 30
# (impact * confidence)/100
confidence: 30
risk_score: 9
context:
- Source:Endpoint
@@ -47,5 +48,4 @@ tags:
type: User
role:
- attacker
automated_detection_testing: passed