From e5ae722014b8038cd91847e6353bf37e1d507fb2 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 20 Aug 2021 13:59:06 +0200
Subject: [PATCH 01/11] dev_git

---
 .../github_commit_changes_in_master.yml       | 52 +++++++++++++++++++
 macros/github.yml                             |  4 ++
 .../github_commit_changes_in_master.test.yml  | 12 +++++
 3 files changed, 68 insertions(+)
 create mode 100644 detections/endpoint/github_commit_changes_in_master.yml
 create mode 100644 macros/github.yml
 create mode 100644 tests/endpoint/github_commit_changes_in_master.test.yml

diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml
new file mode 100644
index 0000000000..b06ba23f25
--- /dev/null
+++ b/detections/endpoint/github_commit_changes_in_master.yml
@@ -0,0 +1,52 @@
+name: Github Commit Changes In Master
+id: c9d2bfe2-019f-11ec-a8eb-acde48001122
+version: 1
+date: '2021-08-20'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a pushed or commit to master or main branch. 
+  This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
+  PR for review. of course in some cases admin of the project may did a changes directly to master branch
+search: 'index=github branches{}.name = main
+  |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `github_commit_changes_in_master_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
+known_false_positives: admin can do changes directly to master branch
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 30 
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious commit by $commit.commit.author.email$ to main branch
+  observable:
+  - name: commit.commit.author.email
+    type: User
+    role:
+    - attacker
+
+  
\ No newline at end of file
diff --git a/macros/github.yml b/macros/github.yml
new file mode 100644
index 0000000000..686cb4d1bf
--- /dev/null
+++ b/macros/github.yml
@@ -0,0 +1,4 @@
+definition: sourcetype="aws:firehose:json"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: github
\ No newline at end of file
diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/endpoint/github_commit_changes_in_master.test.yml
new file mode 100644
index 0000000000..56ca796b5b
--- /dev/null
+++ b/tests/endpoint/github_commit_changes_in_master.test.yml
@@ -0,0 +1,12 @@
+name: Github Commit Changes In Master Unit Test
+tests:
+- name: Github Commit Changes In Master
+  file: detections/endpoint/github_commit_changes_in_master.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From 89fb2682b0b8b995bbdffbcb4c71da1e27027538 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 20 Aug 2021 14:09:49 +0200
Subject: [PATCH 02/11] dev_git

---
 detections/endpoint/github_commit_changes_in_master.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml
index b06ba23f25..698eaeddc4 100644
--- a/detections/endpoint/github_commit_changes_in_master.yml
+++ b/detections/endpoint/github_commit_changes_in_master.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search is to detect a pushed or commit to master or main branch. 
   This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
   PR for review. of course in some cases admin of the project may did a changes directly to master branch
-search: 'index=github branches{}.name = main
+search: '`github` branches{}.name = main
   |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`

From b0c2e80271e35842477a097542d4031c42475b3b Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 09:06:58 +0200
Subject: [PATCH 03/11] dev_git

---
 .../endpoint/github_commit_changes_in_master.yml       |  4 ++--
 .../endpoint/github_commit_changes_in_master.test.yml  | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/endpoint/github_commit_changes_in_master.yml
index 698eaeddc4..86bf3bfb84 100644
--- a/detections/endpoint/github_commit_changes_in_master.yml
+++ b/detections/endpoint/github_commit_changes_in_master.yml
@@ -23,11 +23,11 @@ tags:
   analytic_story:
   - DevSecOps
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1003.002
+  - T1199
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/endpoint/github_commit_changes_in_master.test.yml
index 56ca796b5b..0c1039d1b2 100644
--- a/tests/endpoint/github_commit_changes_in_master.test.yml
+++ b/tests/endpoint/github_commit_changes_in_master.test.yml
@@ -1,12 +1,12 @@
 name: Github Commit Changes In Master Unit Test
 tests:
 - name: Github Commit Changes In Master
-  file: detections/endpoint/github_commit_changes_in_master.yml
+  file: endpoint/github_commit_changes_in_master.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: github_push_master.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log
+    source: github
+    sourcetype: aws:firehose:json
\ No newline at end of file

From 7804f96d6750d7b778c7499f9041f7589051f6da Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 18:52:55 +0200
Subject: [PATCH 04/11] dev_git

---
 .../{endpoint => cloud}/github_commit_changes_in_master.yml    | 3 +--
 .../github_commit_changes_in_master.test.yml                   | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)
 rename detections/{endpoint => cloud}/github_commit_changes_in_master.yml (98%)
 rename tests/{endpoint => cloud}/github_commit_changes_in_master.test.yml (89%)

diff --git a/detections/endpoint/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml
similarity index 98%
rename from detections/endpoint/github_commit_changes_in_master.yml
rename to detections/cloud/github_commit_changes_in_master.yml
index 86bf3bfb84..73636df24e 100644
--- a/detections/endpoint/github_commit_changes_in_master.yml
+++ b/detections/cloud/github_commit_changes_in_master.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: This search is to detect a pushed or commit to master or main branch. 
   This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
   PR for review. of course in some cases admin of the project may did a changes directly to master branch
diff --git a/tests/endpoint/github_commit_changes_in_master.test.yml b/tests/cloud/github_commit_changes_in_master.test.yml
similarity index 89%
rename from tests/endpoint/github_commit_changes_in_master.test.yml
rename to tests/cloud/github_commit_changes_in_master.test.yml
index 0c1039d1b2..7c0ea5df89 100644
--- a/tests/endpoint/github_commit_changes_in_master.test.yml
+++ b/tests/cloud/github_commit_changes_in_master.test.yml
@@ -1,7 +1,7 @@
 name: Github Commit Changes In Master Unit Test
 tests:
 - name: Github Commit Changes In Master
-  file: endpoint/github_commit_changes_in_master.yml
+  file: cloud/github_commit_changes_in_master.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 0cafcd4f87d8b3cfba96c53bde5a4bd0e0906821 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 20:06:39 +0200
Subject: [PATCH 05/11] dev_sec2

---
 ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
new file mode 100644
index 0000000000..440dbbf50b
--- /dev/null
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -0,0 +1,57 @@
+name: Gsuite Email With Known Abuse Web Service Link
+id: 8630aa22-042b-11ec-af39-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
+  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
+| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_email_with_known_abuse_web_service_link_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
+references:
+- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file

From 426d5c4c850ee05b6dd26025a3ebe78622758923 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 12:58:41 +0200
Subject: [PATCH 06/11] dev_git

---
 tests/cloud/github_commit_changes_in_master.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/cloud/github_commit_changes_in_master.test.yml b/tests/cloud/github_commit_changes_in_master.test.yml
index 7c0ea5df89..6901948db5 100644
--- a/tests/cloud/github_commit_changes_in_master.test.yml
+++ b/tests/cloud/github_commit_changes_in_master.test.yml
@@ -3,7 +3,7 @@ tests:
 - name: Github Commit Changes In Master
   file: cloud/github_commit_changes_in_master.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-30d'
   latest_time: 'now'
   attack_data:
   - file_name: github_push_master.log

From db38f31f3c050dbb2e4aa8ce412279fd658692df Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 12:59:16 +0200
Subject: [PATCH 07/11] Delete
 gsuite_email_with_known_abuse_web_service_link.yml

---
 ...mail_with_known_abuse_web_service_link.yml | 57 -------------------
 1 file changed, 57 deletions(-)
 delete mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
deleted file mode 100644
index 440dbbf50b..0000000000
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Gsuite Email With Known Abuse Web Service Link
-id: 8630aa22-042b-11ec-af39-acde48001122
-version: 1
-date: '2021-08-23'
-author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel: []
-description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
-  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
-| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `gsuite_email_with_known_abuse_web_service_link_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
-references:
-- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious email from $source.address$ to $destination{}.address$
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address 
-    type: User
-    role:
-    - Victim
-  
\ No newline at end of file

From b90326f55c847a8bf4c7126a60de3e3f8943293f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 13:28:06 +0200
Subject: [PATCH 08/11] dev_git

---
 macros/github.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/macros/github.yml b/macros/github.yml
index 686cb4d1bf..5064aa92ed 100644
--- a/macros/github.yml
+++ b/macros/github.yml
@@ -1,4 +1,4 @@
-definition: sourcetype="aws:firehose:json"
+definition: sourcetype=aws:firehose:json
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: github
\ No newline at end of file

From 4cd7b43ed0ed57bbc91cafe06c6bd8a16867e00f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-207-55>
Date: Fri, 27 Aug 2021 11:49:55 +0000
Subject: [PATCH 09/11] Added detection testing service results inGithub Commit
 Changes In Master

---
 .../cloud/github_commit_changes_in_master.yml | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml
index 73636df24e..309a3a0571 100644
--- a/detections/cloud/github_commit_changes_in_master.yml
+++ b/detections/cloud/github_commit_changes_in_master.yml
@@ -5,16 +5,18 @@ date: '2021-08-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a pushed or commit to master or main branch. 
-  This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
-  PR for review. of course in some cases admin of the project may did a changes directly to master branch
-search: '`github` branches{}.name = main
-  |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `github_commit_changes_in_master_filter`'
+description: This search is to detect a pushed or commit to master or main branch.
+  This is to avoid unwanted modification to master without a review to the changes.
+  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
+  of course in some cases admin of the project may did a changes directly to master
+  branch
+search: '`github` branches{}.name = main |  stats count min(_time) as firstTime max(_time)
+  as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login
+  commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
+  logs related to github logs having the fork, commit, push metadata that can be use
+  to monitor the changes in a github project.
 known_false_positives: admin can do changes directly to master branch
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
@@ -35,8 +37,7 @@ tags:
   - _time
   security_domain: endpoint
   impact: 30
-  confidence: 30 
-  # (impact * confidence)/100
+  confidence: 30
   risk_score: 9
   context:
   - Source:Endpoint
@@ -47,5 +48,4 @@ tags:
     type: User
     role:
     - attacker
-
-  
\ No newline at end of file
+  automated_detection_testing: passed

From cdc6665afd38709c58b409660b5b6669baf3a4d7 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 27 Aug 2021 14:01:41 +0200
Subject: [PATCH 10/11] dev_git

---
 detections/cloud/github_commit_changes_in_master.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml
index 73636df24e..55c2f1309c 100644
--- a/detections/cloud/github_commit_changes_in_master.yml
+++ b/detections/cloud/github_commit_changes_in_master.yml
@@ -8,7 +8,7 @@ datamodel: []
 description: This search is to detect a pushed or commit to master or main branch. 
   This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
   PR for review. of course in some cases admin of the project may did a changes directly to master branch
-search: '`github` branches{}.name = main
+search: '`github` branches{}.name = main OR branches{}.name = master
   |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`

From 2953ba3cbc31d902320219839abc54cb3f5a6dda Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 27 Aug 2021 14:04:26 +0200
Subject: [PATCH 11/11] Update github_commit_changes_in_master.yml

---
 detections/cloud/github_commit_changes_in_master.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml
index e9f2216461..664e6696d0 100644
--- a/detections/cloud/github_commit_changes_in_master.yml
+++ b/detections/cloud/github_commit_changes_in_master.yml
@@ -5,7 +5,6 @@ date: '2021-08-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-<<<<<<< HEAD
 description: This search is to detect a pushed or commit to master or main branch. 
   This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
   PR for review. of course in some cases admin of the project may did a changes directly to master branch
@@ -14,17 +13,6 @@ search: '`github` branches{}.name = main OR branches{}.name = master
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `github_commit_changes_in_master_filter`'
-=======
-description: This search is to detect a pushed or commit to master or main branch.
-  This is to avoid unwanted modification to master without a review to the changes.
-  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
-  of course in some cases admin of the project may did a changes directly to master
-  branch
-search: '`github` branches{}.name = main |  stats count min(_time) as firstTime max(_time)
-  as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login
-  commit.commit.message repository.pushed_at commit.commit.committer.date | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
->>>>>>> 4cd7b43ed0ed57bbc91cafe06c6bd8a16867e00f
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to github logs having the fork, commit, push metadata that can be use
   to monitor the changes in a github project.