admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dev_git

Browse Source
This commit is contained in:
tccontre
2021-08-20 14:09:49 +02:00
parent e5ae722014
commit 89fb2682b0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/github_commit_changes_in_master.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: This search is to detect a pushed or commit to master or main branch.
This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a
PR for review. of course in some cases admin of the project may did a changes directly to master branch
search: 'index=github branches{}.name = main
search: '`github` branches{}.name = main
| stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`