admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated detections

Browse Source
This commit is contained in:
P4T12ICK
2021-09-06 13:14:33 +02:00
parent 45fd279a31
commit 565c49ee63
4 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/circle_ci_disable_security_job.yml
+3 -2
View File
@@ -7,11 +7,12 @@ type: Anomaly
datamodel: []
description: This search looks for disable security job in CircleCI pipeline.
search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval
mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
mandatory_job_executed=0 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
mandatory_job_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `circle_ci_disable_security_job_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
detections/cloud/circle_ci_disable_security_step.yml
+2 -1
View File
@@ -11,7 +11,8 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
* , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | `security_content_ctime(firstTime)`
"%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0
| rex field=url "(?<repository>[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
how_to_implement: You must index CircleCI logs.
known_false_positives: unknown
detections/cloud/github_dependabot_alert.yml
+2 -2
View File
@@ -7,10 +7,10 @@ type: Anomaly
datamodel: []
description: This search looks for Dependabot Alerts in Github logs.
search: '`github` alert.id=* action=create | rename repository.full_name as repository,
repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time)
as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
alert.external_identifier alert.external_reference alert.fixed_in alert.severity
repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
repository repository_url user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_dependabot_alert_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
detections/cloud/github_pull_request_from_unknown_user.yml
+4 -3
View File
@@ -7,11 +7,12 @@ type: Anomaly
datamodel: []
description: This search looks for Pull Request from unknown user.
search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
repository.full_name check_suite.pull_requests{}.head.ref
check_suite.head_commit.message | rename check_suite.head_commit.author.name as
user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
user repository.full_name as repository check_suite.pull_requests{}.head.ref
as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_pull_request_from_unknown_user_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs.
known_false_positives: unknown