From 8d51af0e5340fe53ff75ef92ea789dbcfbf018c8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 1 Sep 2021 10:54:03 +0200 Subject: [PATCH 1/7] add dataset --- .../cloud/github_security_advisor_alert.yml | 61 +++++++++++++++++++ .../github_security_advisor_alert.test.yml | 12 ++++ 2 files changed, 73 insertions(+) create mode 100644 detections/cloud/github_security_advisor_alert.yml create mode 100644 tests/cloud/github_security_advisor_alert.test.yml diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml new file mode 100644 index 0000000000..cf9556055c --- /dev/null +++ b/detections/cloud/github_security_advisor_alert.yml @@ -0,0 +1,61 @@ +name: GitHub Security Advisor Alert +id: 05032b04-4469-4034-9df7-05f607d75cba +version: 1 +date: '2021-09-01' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for Security Advisor Alerts in Github logs. +search: '`github` alert.id=* action=create + | rename repository.full_name as repository, repository.html_url as repository_url + | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name + alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in + alert.severity repository repository_url + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `github_security_advisor_alert_filter`' +how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. +known_false_positives: unknown +references: +- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html +tags: + analytic_story: + - Dev Sec Ops + asset_type: GitHub + cis20: + - CIS 13 + confidence: 90 + impact: 30 + kill_chain_phases: + - Actions on Objectives + message: Vulnerabilities found in packages used by GitHub repository $repository$ + mitre_attack_id: + - T1195.001 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: repository + type: System + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Dev Sec Ops Analytics + required_fields: + - _time + - alert.id + - repository.full_name + - repository.html_url + - action + - alert.affected_package_name + - alert.affected_range + - alert.created_at + - alert.external_identifier + - alert.external_reference + - alert.fixed_in + - alert.severity + risk_score: 21 + security_domain: network diff --git a/tests/cloud/github_security_advisor_alert.test.yml b/tests/cloud/github_security_advisor_alert.test.yml new file mode 100644 index 0000000000..ad361ef2ea --- /dev/null +++ b/tests/cloud/github_security_advisor_alert.test.yml @@ -0,0 +1,12 @@ +name: GitHub Security Advisor Alert Unit Test +tests: +- name: GitHub Security Advisor Alert + file: cloud/github_security_advisor_alert.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: github_security_advisor_alert.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json + sourcetype: aws:firehose:json + source: github From 3f72e0d89d42052e9603ffd3387c7643cea544f3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 1 Sep 2021 10:58:22 +0200 Subject: [PATCH 2/7] adjusted risk score --- detections/cloud/github_security_advisor_alert.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml index cf9556055c..fd843be197 100644 --- a/detections/cloud/github_security_advisor_alert.yml +++ b/detections/cloud/github_security_advisor_alert.yml @@ -57,5 +57,5 @@ tags: - alert.external_reference - alert.fixed_in - alert.severity - risk_score: 21 + risk_score: 27 security_domain: network From 206926dfbb9fab22295412c9c9b8aad97bac70d0 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 1 Sep 2021 09:22:07 +0000 Subject: [PATCH 3/7] Added detection testing service results inGitHub Security Advisor Alert --- .../cloud/github_security_advisor_alert.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml index fd843be197..2fafe499b4 100644 --- a/detections/cloud/github_security_advisor_alert.yml +++ b/detections/cloud/github_security_advisor_alert.yml @@ -6,14 +6,14 @@ author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] description: This search looks for Security Advisor Alerts in Github logs. -search: '`github` alert.id=* action=create - | rename repository.full_name as repository, repository.html_url as repository_url - | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name - alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in - alert.severity repository repository_url - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`github` alert.id=* action=create | rename repository.full_name as repository, + repository.html_url as repository_url | stats min(_time) as firstTime max(_time) + as lastTime by action alert.affected_package_name alert.affected_range alert.created_at + alert.external_identifier alert.external_reference alert.fixed_in alert.severity + repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_security_advisor_alert_filter`' -how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. +how_to_implement: You must index GitHub logs. You can follow the url in reference + to onboard GitHub logs. known_false_positives: unknown references: - https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html @@ -59,3 +59,6 @@ tags: - alert.severity risk_score: 27 security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json From 175fcfc3d8f63623a44352aa5ae93928eb287975 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 1 Sep 2021 11:28:05 +0200 Subject: [PATCH 4/7] github detections --- ...curity_advisor_alert.yml => github_dependabot_alert.yml} | 4 ++-- ...isor_alert.test.yml => github_dependabot_alert.test.yml} | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) rename detections/cloud/{github_security_advisor_alert.yml => github_dependabot_alert.yml} (93%) rename tests/cloud/{github_security_advisor_alert.test.yml => github_dependabot_alert.test.yml} (75%) diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_dependabot_alert.yml similarity index 93% rename from detections/cloud/github_security_advisor_alert.yml rename to detections/cloud/github_dependabot_alert.yml index fd843be197..ae61fcc4ec 100644 --- a/detections/cloud/github_security_advisor_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -1,11 +1,11 @@ -name: GitHub Security Advisor Alert +name: GitHub Dependabot Alert id: 05032b04-4469-4034-9df7-05f607d75cba version: 1 date: '2021-09-01' author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] -description: This search looks for Security Advisor Alerts in Github logs. +description: This search looks for Dependabot Alerts in Github logs. search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name diff --git a/tests/cloud/github_security_advisor_alert.test.yml b/tests/cloud/github_dependabot_alert.test.yml similarity index 75% rename from tests/cloud/github_security_advisor_alert.test.yml rename to tests/cloud/github_dependabot_alert.test.yml index ad361ef2ea..7a38c59467 100644 --- a/tests/cloud/github_security_advisor_alert.test.yml +++ b/tests/cloud/github_dependabot_alert.test.yml @@ -1,7 +1,7 @@ -name: GitHub Security Advisor Alert Unit Test +name: GitHub Dependabot Alert Unit Test tests: -- name: GitHub Security Advisor Alert - file: cloud/github_security_advisor_alert.yml +- name: GitHub Dependabot Alert + file: cloud/github_dependabot_alert.yml pass_condition: '| stats count | where count > 0' earliest_time: '-365d' latest_time: 'now' From aa834d87ba199d1f051aa09980024c6e72dab992 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 1 Sep 2021 09:49:38 +0000 Subject: [PATCH 5/7] Added detection testing service results inGitHub Dependabot Alert --- detections/cloud/github_dependabot_alert.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index f30cfa4c01..7a2bdc59b3 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -6,12 +6,11 @@ author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] description: This search looks for Dependabot Alerts in Github logs. -search: '`github` alert.id=* action=create - | rename repository.full_name as repository, repository.html_url as repository_url - | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name - alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in - alert.severity repository repository_url - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`github` alert.id=* action=create | rename repository.full_name as repository, + repository.html_url as repository_url | stats min(_time) as firstTime max(_time) + as lastTime by action alert.affected_package_name alert.affected_range alert.created_at + alert.external_identifier alert.external_reference alert.fixed_in alert.severity + repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`' how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. From dcbc0f95ad738b50a31b1b9d5965dd5e0bb163f4 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 1 Sep 2021 13:56:23 +0200 Subject: [PATCH 6/7] github detection --- .../github_pull_request_from_unknown_user.yml | 64 +++++++++++++++++++ macros/github_known_users.yml | 3 + ...ub_pull_request_from_unknown_user.test.yml | 12 ++++ 3 files changed, 79 insertions(+) create mode 100644 detections/cloud/github_pull_request_from_unknown_user.yml create mode 100644 macros/github_known_users.yml create mode 100644 tests/cloud/github_pull_request_from_unknown_user.test.yml diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml new file mode 100644 index 0000000000..c7eaf731f3 --- /dev/null +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -0,0 +1,64 @@ +name: GitHub Pull Request from Unknown User +id: 9d7b9100-8878-4404-914e-ca5e551a641e +version: 1 +date: '2021-09-01' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for Pull Request from unknown user. +search: '`github` check_suite.pull_requests{}.id=* + | stats count by check_suite.head_commit.author.name check_suite.pull_requests{}.base.repo.name + check_suite.pull_requests{}.head.ref check_suite.head_commit.message + | rename check_suite.head_commit.author.name as user check_suite.pull_requests{}.base.repo.name as repository + check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message + | search NOT `github_known_users` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `github_pull_request_from_unknown_user_filter`' +how_to_implement: You must index GitHub logs. You can follow the url in reference + to onboard GitHub logs. +known_false_positives: unknown +references: +- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html +tags: + analytic_story: + - Dev Sec Ops + asset_type: GitHub + cis20: + - CIS 13 + confidence: 90 + impact: 30 + kill_chain_phases: + - Actions on Objectives + message: Vulnerabilities found in packages used by GitHub repository $repository$ + mitre_attack_id: + - T1195.001 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: repository + type: System + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Dev Sec Ops Analytics + required_fields: + - _time + - alert.id + - repository.full_name + - repository.html_url + - action + - alert.affected_package_name + - alert.affected_range + - alert.created_at + - alert.external_identifier + - alert.external_reference + - alert.fixed_in + - alert.severity + risk_score: 27 + security_domain: network + \ No newline at end of file diff --git a/macros/github_known_users.yml b/macros/github_known_users.yml new file mode 100644 index 0000000000..8350f6bae0 --- /dev/null +++ b/macros/github_known_users.yml @@ -0,0 +1,3 @@ +definition: user IN (user_names_here) +description: specify the user allowed to create PRs in Github projects. +name: github_known_users diff --git a/tests/cloud/github_pull_request_from_unknown_user.test.yml b/tests/cloud/github_pull_request_from_unknown_user.test.yml new file mode 100644 index 0000000000..32d4f347cf --- /dev/null +++ b/tests/cloud/github_pull_request_from_unknown_user.test.yml @@ -0,0 +1,12 @@ +name: GitHub Pull Request from Unknown User Unit Test +tests: +- name: GitHub Pull Request from Unknown User + file: cloud/github_pull_request_from_unknown_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: github_pull_request.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json + sourcetype: aws:firehose:json + source: github From 18835c540b740ac43cf5aa94d3bb002107218bc7 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 1 Sep 2021 12:16:41 +0000 Subject: [PATCH 7/7] Added detection testing service results inGitHub Pull Request from Unknown User --- .../github_pull_request_from_unknown_user.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index c7eaf731f3..456afb76ef 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -6,14 +6,12 @@ author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] description: This search looks for Pull Request from unknown user. -search: '`github` check_suite.pull_requests{}.id=* - | stats count by check_suite.head_commit.author.name check_suite.pull_requests{}.base.repo.name - check_suite.pull_requests{}.head.ref check_suite.head_commit.message - | rename check_suite.head_commit.author.name as user check_suite.pull_requests{}.base.repo.name as repository - check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message - | search NOT `github_known_users` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `github_pull_request_from_unknown_user_filter`' +search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name + check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref + check_suite.head_commit.message | rename check_suite.head_commit.author.name as + user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref + as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`' how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. known_false_positives: unknown @@ -61,4 +59,6 @@ tags: - alert.severity risk_score: 27 security_domain: network - \ No newline at end of file + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json