From 89fb2682b0b8b995bbdffbcb4c71da1e27027538 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 20 Aug 2021 14:09:49 +0200 Subject: [PATCH] dev_git --- detections/endpoint/github_commit_changes_in_master.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml index b06ba23f25..698eaeddc4 100644 --- a/detections/endpoint/github_commit_changes_in_master.yml +++ b/detections/endpoint/github_commit_changes_in_master.yml @@ -9,7 +9,7 @@ datamodel: description: This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch -search: 'index=github branches{}.name = main +search: '`github` branches{}.name = main | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`