From 0303ff06b99e8d5b466692771358e1226f253661 Mon Sep 17 00:00:00 2001
From: divious1 <josehelps@gmail.com>
Date: Wed, 25 Aug 2021 17:14:31 -0400
Subject: [PATCH 01/21] updating detection from feedback in issue 1557

---
 ...eating_lnk_file_in_suspicious_location.yml | 32 +++++++++++--------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index fcb8010707..3a7c021ac2 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -1,24 +1,30 @@
 name: Process Creating LNK file in Suspicious Location
 id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
-version: 4
-date: '2021-01-28'
+version: 5
+date: '2021-08-25'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+  - Endpoint
 description: This search looks for a process launching an `*.lnk` file under `C:\User*`
   or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
-  AND Filesystem.file_path="C:\\Temp*"  by _time span=1h Filesystem.process_id Filesystem.file_name
-  Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
-  | rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") 
+  by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user 
+  | `drop_dm_object_name(Filesystem)`
+  | rename process_guid as lnk_guid 
+  | join lnk_guid, _time [| tstats `security_content_summariesonly`
   count FROM datamodel=Endpoint.Processes where Processes.process_name=*  by _time
-  span=1h Processes.parent_process_id Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
-  | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
-  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
-  process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` '
+  span=1h Processes.parent_process_guid Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process 
+  | `drop_dm_object_name(Processes)`
+  | rename parent_process_id as lnk_guid 
+  | fields _time lnk_guid process_id dest process_name
+  process_path process] 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | table firstTime, lastTime, lnk_gui, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash 
+  | `process_creating_lnk_file_in_suspicious_location_filter` '
 how_to_implement: You must be ingesting data that records filesystem and process activity
   from your hosts to populate the Endpoint data model. This is typically populated
   via endpoint detection-and-response product, such as Carbon Black, or endpoint data

From 1f5c139f60b2a1296a89e829938a9cda3cc9f5dc Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 12:09:55 -0700
Subject: [PATCH 02/21] Update
 process_creating_lnk_file_in_suspicious_location.yml

---
 .../process_creating_lnk_file_in_suspicious_location.yml         | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 3a7c021ac2..28e7eef459 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -83,3 +83,4 @@ tags:
   - Filesystem.user
   risk_score: 63
   security_domain: network
+

From 7f8a3bebb6dfc1903160d13ce84683f24ef6dc1b Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 12:45:02 -0700
Subject: [PATCH 03/21] update links and content

---
 docs/README.md | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/docs/README.md b/docs/README.md
index d9ebb8dba3..8b27943df9 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,8 +7,8 @@ This project gives you access to our repository of Analytic Stories that are sec
 
 ## View Our Content
 
-* [Analytic Stories](docs/stories.md)
-* [Detections](docs/detections.md)
+* [Analytic Stories](https://github.com/splunk/security_content/tree/develop/docs/stories.md)
+* [Detections](https://github.com/splunk/security_content/tree/develop/docs/detections.md)
 
 If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):
 
@@ -34,7 +34,7 @@ If you want to help the rest of the security community by sharing your own detec
 * [detections/](https://github.com/splunk/security_content/tree/develop/detections): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
 * [response_tasks/](https://github.com/splunk/security_content/tree/develop/response_tasks): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
 * [responses/](https://github.com/splunk/security_content/tree/develop/responses): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
-* [baselines/](https://github.com/splunk/security_content/tree/develop/baselines): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+
 
 #### Content Spec Files
 * [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md)
@@ -42,6 +42,16 @@ If you want to help the rest of the security community by sharing your own detec
 * [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
 * [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
 * [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
-* [baselines](https://github.com/splunk/security_content/blob/develop/docs/spec/baselines.spec.md)
 * [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
 * [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)
+
+# MITRE ATT&CK ⚔️
+### Detection Coverage
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+
+![](https://github.com/splunk/security_content/blob/develop/docs/mitre-map/coverage.png)
+
+### Detection Priority by Threat Actors
+If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer in [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/). Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.
+
+![](https://github.com/splunk/security_content/blob/develop/docs/mitre-map/priority.png)

From 542a841ad704f4eac447a77e4abccf33d3ead698 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 12:54:56 -0700
Subject: [PATCH 04/21] CI

---
 docs/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/README.md b/docs/README.md
index 8b27943df9..2ad0e8a6a6 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -55,3 +55,4 @@ To view an up-to-date detection coverage map for all the content tagged with MIT
 If curious about how the Threat Research team prioritizes what content to build refer to our **Detection Priority by Threat Actors** layer in [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/). Using the actor data from [MITRE CTI](https://github.com/mitre/cti) we add a point for every threat actor that uses a particular technique, and then subtract a point of every detection we have mapped to that technique. The resulting map below is how we prioritize what techniques and detections to focus on next. This map is automatically updated on every release and is generated by the [generate-actors-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-actors-map.py) script.
 
 ![](https://github.com/splunk/security_content/blob/develop/docs/mitre-map/priority.png)
+

From 39db6357ae98a01de062349ed0253f986c7cce8e Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 13:08:47 -0700
Subject: [PATCH 05/21] Update
 process_creating_lnk_file_in_suspicious_location.yml

---
 .../process_creating_lnk_file_in_suspicious_location.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 28e7eef459..78b5d67d35 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -1,7 +1,7 @@
 name: Process Creating LNK file in Suspicious Location
 id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
 version: 5
-date: '2021-08-25'
+date: '2021-08-26'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel: 

From 7a7341f9bac7a6d9e3404c80ce33b6859de2269e Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 13:48:25 -0700
Subject: [PATCH 06/21] spl update

---
 ...eating_lnk_file_in_suspicious_location.yml | 33 ++++++++++---------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 28e7eef459..ae02da2623 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -9,22 +9,23 @@ datamodel:
 description: This search looks for a process launching an `*.lnk` file under `C:\User*`
   or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") 
-  by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user 
-  | `drop_dm_object_name(Filesystem)`
-  | rename process_guid as lnk_guid 
-  | join lnk_guid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes where Processes.process_name=*  by _time
-  span=1h Processes.parent_process_guid Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process 
-  | `drop_dm_object_name(Processes)`
-  | rename parent_process_id as lnk_guid 
-  | fields _time lnk_guid process_id dest process_name
-  process_path process] 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | table firstTime, lastTime, lnk_gui, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash 
-  | `process_creating_lnk_file_in_suspicious_location_filter` '
+    as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") 
+    by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user 
+| `drop_dm_object_name(Filesystem)` 
+| rename process_guid as lnk_guid 
+| join lnk_guid, _time 
+    [| tstats `security_content_summariesonly`
+        count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
+        span=1h Processes.parent_process_guid Processes.process_id Processes.process_name
+        Processes.dest Processes.process_path Processes.process 
+    | `drop_dm_object_name(Processes)` 
+    | rename parent_process_guid as lnk_guid 
+    | fields _time lnk_guid process_id dest process_name
+        process_path process] 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash 
+| `process_creating_lnk_file_in_suspicious_location_filter`'
 how_to_implement: You must be ingesting data that records filesystem and process activity
   from your hosts to populate the Endpoint data model. This is typically populated
   via endpoint detection-and-response product, such as Carbon Black, or endpoint data

From 9ef84b385f25d517342f1cddc6a32aaef4156bdd Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 31 Aug 2021 13:56:19 -0700
Subject: [PATCH 07/21] added a .semgrepignore file to ignore erroneous eval
 errors from semgrep. eval is used in spl files and does not present a
 security risk.

---
 .semgrepignore | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .semgrepignore

diff --git a/.semgrepignore b/.semgrepignore
new file mode 100644
index 0000000000..d153b2bfb0
--- /dev/null
+++ b/.semgrepignore
@@ -0,0 +1,31 @@
+# This file uses .gitignore syntax:
+#
+# To ignore a file anywhere it occurs in your project, enter a
+# glob pattern here. E.g. "*.min.js".
+#
+# To ignore a directory anywhere it occurs in your project, add
+# a trailing slash to the file name. E.g. "dist/".
+#
+# To ignore a file or directory only relative to the project root,
+# include a slash anywhere except the last character. E.g.
+# "/dist/", or "src/generated".
+#
+# Some parts of .gitignore syntax are not supported, and patterns
+# using this syntax will be dropped from the ignore list:
+# - Explicit "include syntax", e.g. "!kept/".
+# - Multi-character expansion syntax, e.g. "*.py[cod]"
+#
+# To include ignore patterns from another file, start a line
+# with ':include', followed by the path of the file. E.g.
+# ":include path/to/other/ignore/file".
+#
+# To ignore a file with a literal ':' character, escape it with
+# a backslash, e.g. "\:foo".
+
+# Ignore git items
+.gitignore
+.git/
+:include .gitignore
+
+#spl files may contain eval and other statements that should NOT trigger semgrep warnings
+*.spl
\ No newline at end of file

From 027c8341a6d77225813a2cb87d16cf1a2c7bfcb3 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 31 Aug 2021 13:58:52 -0700
Subject: [PATCH 08/21] Added newline at the end of the .semgrepignore file

---
 .semgrepignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.semgrepignore b/.semgrepignore
index d153b2bfb0..963b47842d 100644
--- a/.semgrepignore
+++ b/.semgrepignore
@@ -28,4 +28,4 @@
 :include .gitignore
 
 #spl files may contain eval and other statements that should NOT trigger semgrep warnings
-*.spl
\ No newline at end of file
+*.spl

From fa530705dacad0237bf0418276bbffd19d7d5767 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 14:47:46 -0700
Subject: [PATCH 09/21] update links

---
 docs/README.md | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/README.md b/docs/README.md
index 2ad0e8a6a6..93eb6daccd 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,8 +7,8 @@ This project gives you access to our repository of Analytic Stories that are sec
 
 ## View Our Content
 
-* [Analytic Stories](https://github.com/splunk/security_content/tree/develop/docs/stories.md)
-* [Detections](https://github.com/splunk/security_content/tree/develop/docs/detections.md)
+* [Analytic Stories](https://github.com/splunk/security_content/blob/develop/docs/stories.md)
+* [Detections](https://github.com/splunk/security_content/blob/develop/docs/detections.md)
 
 If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest):
 
@@ -26,7 +26,7 @@ The [attack_range](https://github.com/splunk/attack_range) project allows you to
 If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security_content#support).
 
 ## Contribute Content
-If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!
+If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project). Digital defenders unite!
 
 
 ## Content Parts
@@ -37,13 +37,13 @@ If you want to help the rest of the security community by sharing your own detec
 
 
 #### Content Spec Files
-* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.spec.md)
-* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.spec.md)
-* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.spec.md)
-* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.spec.md)
-* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.spec.md)
-* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.spec.md)
-* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.spec.md)
+* [stories](https://github.com/splunk/security_content/blob/develop/docs/spec/stories.md)
+* [detections](https://github.com/splunk/security_content/blob/develop/docs/spec/detections.md)
+* [deployments](https://github.com/splunk/security_content/blob/develop/docs/spec/deployments.md)
+* [responses](https://github.com/splunk/security_content/blob/develop/docs/spec/responses.md)
+* [response_tasks](https://github.com/splunk/security_content/blob/develop/docs/spec/response_tasks.md)
+* [lookups](https://github.com/splunk/security_content/blob/develop/docs/spec/lookups.md)
+* [macros](https://github.com/splunk/security_content/blob/develop/docs/spec/macros.md)
 
 # MITRE ATT&CK ⚔️
 ### Detection Coverage

From d39bd68abc4e0d23bb7dc004aefc177f7675447a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 31 Aug 2021 15:10:18 -0700
Subject: [PATCH 10/21] Ignoring the dist directory, which contains the Splunk
 Packaging Toolkit

---
 .semgrepignore | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.semgrepignore b/.semgrepignore
index 963b47842d..396c610fe3 100644
--- a/.semgrepignore
+++ b/.semgrepignore
@@ -29,3 +29,7 @@
 
 #spl files may contain eval and other statements that should NOT trigger semgrep warnings
 *.spl
+
+#Temporarily ignoring this directory as we discuss a path moving forward
+#for Splunk Packaging Toolkit Update Strategy
+/dist/

From 67b8963f8cc5580ace5eaa1b4fe29f26426e4d2a Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 15:43:37 -0700
Subject: [PATCH 11/21] Update .semgrepignore

---
 .semgrepignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.semgrepignore b/.semgrepignore
index 396c610fe3..4d19091401 100644
--- a/.semgrepignore
+++ b/.semgrepignore
@@ -33,3 +33,5 @@
 #Temporarily ignoring this directory as we discuss a path moving forward
 #for Splunk Packaging Toolkit Update Strategy
 /dist/
+
+

From 8d51af0e5340fe53ff75ef92ea789dbcfbf018c8 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 1 Sep 2021 10:54:03 +0200
Subject: [PATCH 12/21] add dataset

---
 .../cloud/github_security_advisor_alert.yml   | 61 +++++++++++++++++++
 .../github_security_advisor_alert.test.yml    | 12 ++++
 2 files changed, 73 insertions(+)
 create mode 100644 detections/cloud/github_security_advisor_alert.yml
 create mode 100644 tests/cloud/github_security_advisor_alert.test.yml

diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml
new file mode 100644
index 0000000000..cf9556055c
--- /dev/null
+++ b/detections/cloud/github_security_advisor_alert.yml
@@ -0,0 +1,61 @@
+name: GitHub Security Advisor Alert
+id: 05032b04-4469-4034-9df7-05f607d75cba
+version: 1
+date: '2021-09-01'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for Security Advisor Alerts in Github logs.
+search: '`github` alert.id=* action=create 
+  | rename repository.full_name as repository, repository.html_url as repository_url
+  | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name 
+  alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in 
+  alert.severity repository repository_url
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `github_security_advisor_alert_filter`'
+how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
+known_false_positives: unknown
+references:
+- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: GitHub
+  cis20:
+  - CIS 13
+  confidence: 90
+  impact: 30
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities found in packages used by GitHub repository $repository$
+  mitre_attack_id:
+  - T1195.001
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repository
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  - alert.id
+  - repository.full_name
+  - repository.html_url
+  - action
+  - alert.affected_package_name
+  - alert.affected_range
+  - alert.created_at
+  - alert.external_identifier
+  - alert.external_reference
+  - alert.fixed_in
+  - alert.severity
+  risk_score: 21
+  security_domain: network
diff --git a/tests/cloud/github_security_advisor_alert.test.yml b/tests/cloud/github_security_advisor_alert.test.yml
new file mode 100644
index 0000000000..ad361ef2ea
--- /dev/null
+++ b/tests/cloud/github_security_advisor_alert.test.yml
@@ -0,0 +1,12 @@
+name: GitHub Security Advisor Alert Unit Test
+tests:
+- name: GitHub Security Advisor Alert
+  file: cloud/github_security_advisor_alert.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-365d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: github_security_advisor_alert.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json
+    sourcetype: aws:firehose:json
+    source: github

From 3f72e0d89d42052e9603ffd3387c7643cea544f3 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 1 Sep 2021 10:58:22 +0200
Subject: [PATCH 13/21] adjusted risk score

---
 detections/cloud/github_security_advisor_alert.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml
index cf9556055c..fd843be197 100644
--- a/detections/cloud/github_security_advisor_alert.yml
+++ b/detections/cloud/github_security_advisor_alert.yml
@@ -57,5 +57,5 @@ tags:
   - alert.external_reference
   - alert.fixed_in
   - alert.severity
-  risk_score: 21
+  risk_score: 27
   security_domain: network

From 9c0d23135712ed90df743f4bec6d8212d3f0e8f6 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 1 Sep 2021 11:13:52 +0200
Subject: [PATCH 14/21] devsec3

---
 detections/cloud/github_commit_in_develop.yml | 50 +++++++++++++++++++
 tests/cloud/github_commit_in_develop.test.yml | 12 +++++
 2 files changed, 62 insertions(+)
 create mode 100644 detections/cloud/github_commit_in_develop.yml
 create mode 100644 tests/cloud/github_commit_in_develop.test.yml

diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml
new file mode 100644
index 0000000000..c69ba007d8
--- /dev/null
+++ b/detections/cloud/github_commit_in_develop.yml
@@ -0,0 +1,50 @@
+name: Github Commit In Develop
+id: f3030cb6-0b02-11ec-8f22-acde48001122
+version: 1
+date: '2021-09-01'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This search is to detect a pushed or commit to develop branch.
+  This is to avoid unwanted modification to develop without a review to the changes.
+  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
+  of course in some cases admin of the project may did a changes directly to master
+  branch
+search: '`github` branches{}.name = main OR branches{}.name = develop |  stats count
+  min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email
+  commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_in_develop_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to github logs having the fork, commit, push metadata that can be use
+  to monitor the changes in a github project.
+known_false_positives: admin can do changes directly to develop branch
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_develop.json
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: suspicious commit by $commit.commit.author.email$ to develop branch
+  mitre_attack_id:
+  - T1199
+  observable:
+  - name: commit.commit.author.email
+    type: User
+    role:
+    - attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 9
+  security_domain: endpoint
diff --git a/tests/cloud/github_commit_in_develop.test.yml b/tests/cloud/github_commit_in_develop.test.yml
new file mode 100644
index 0000000000..056ff094e3
--- /dev/null
+++ b/tests/cloud/github_commit_in_develop.test.yml
@@ -0,0 +1,12 @@
+name: Github Commit In Develop Unit Test
+tests:
+- name: Github Commit In Develop
+  file: cloud/github_commit_in_develop.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: github_push_develop.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_develop.json
+    source: github
+    sourcetype: aws:firehose:json
\ No newline at end of file

From 206926dfbb9fab22295412c9c9b8aad97bac70d0 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-74-61>
Date: Wed, 1 Sep 2021 09:22:07 +0000
Subject: [PATCH 15/21] Added detection testing service results inGitHub
 Security Advisor Alert

---
 .../cloud/github_security_advisor_alert.yml     | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_security_advisor_alert.yml
index fd843be197..2fafe499b4 100644
--- a/detections/cloud/github_security_advisor_alert.yml
+++ b/detections/cloud/github_security_advisor_alert.yml
@@ -6,14 +6,14 @@ author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel: []
 description: This search looks for Security Advisor Alerts in Github logs.
-search: '`github` alert.id=* action=create 
-  | rename repository.full_name as repository, repository.html_url as repository_url
-  | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name 
-  alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in 
-  alert.severity repository repository_url
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`github` alert.id=* action=create | rename repository.full_name as repository,
+  repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
+  as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
+  alert.external_identifier alert.external_reference alert.fixed_in alert.severity
+  repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `github_security_advisor_alert_filter`'
-how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
+how_to_implement: You must index GitHub logs. You can follow the url in reference
+  to onboard GitHub logs.
 known_false_positives: unknown
 references:
 - https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
@@ -59,3 +59,6 @@ tags:
   - alert.severity
   risk_score: 27
   security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json

From 175fcfc3d8f63623a44352aa5ae93928eb287975 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 1 Sep 2021 11:28:05 +0200
Subject: [PATCH 16/21] github detections

---
 ...curity_advisor_alert.yml => github_dependabot_alert.yml} | 4 ++--
 ...isor_alert.test.yml => github_dependabot_alert.test.yml} | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename detections/cloud/{github_security_advisor_alert.yml => github_dependabot_alert.yml} (93%)
 rename tests/cloud/{github_security_advisor_alert.test.yml => github_dependabot_alert.test.yml} (75%)

diff --git a/detections/cloud/github_security_advisor_alert.yml b/detections/cloud/github_dependabot_alert.yml
similarity index 93%
rename from detections/cloud/github_security_advisor_alert.yml
rename to detections/cloud/github_dependabot_alert.yml
index fd843be197..ae61fcc4ec 100644
--- a/detections/cloud/github_security_advisor_alert.yml
+++ b/detections/cloud/github_dependabot_alert.yml
@@ -1,11 +1,11 @@
-name: GitHub Security Advisor Alert
+name: GitHub Dependabot Alert
 id: 05032b04-4469-4034-9df7-05f607d75cba
 version: 1
 date: '2021-09-01'
 author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel: []
-description: This search looks for Security Advisor Alerts in Github logs.
+description: This search looks for Dependabot Alerts in Github logs.
 search: '`github` alert.id=* action=create 
   | rename repository.full_name as repository, repository.html_url as repository_url
   | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name 
diff --git a/tests/cloud/github_security_advisor_alert.test.yml b/tests/cloud/github_dependabot_alert.test.yml
similarity index 75%
rename from tests/cloud/github_security_advisor_alert.test.yml
rename to tests/cloud/github_dependabot_alert.test.yml
index ad361ef2ea..7a38c59467 100644
--- a/tests/cloud/github_security_advisor_alert.test.yml
+++ b/tests/cloud/github_dependabot_alert.test.yml
@@ -1,7 +1,7 @@
-name: GitHub Security Advisor Alert Unit Test
+name: GitHub Dependabot Alert Unit Test
 tests:
-- name: GitHub Security Advisor Alert
-  file: cloud/github_security_advisor_alert.yml
+- name: GitHub Dependabot Alert
+  file: cloud/github_dependabot_alert.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-365d'
   latest_time: 'now'

From 9c78d18f74c0a1717ec031147646c8896d43b87b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-19-72>
Date: Wed, 1 Sep 2021 09:36:59 +0000
Subject: [PATCH 17/21] Added detection testing service results inGithub Commit
 In Develop

---
 detections/cloud/github_commit_in_develop.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml
index c69ba007d8..2b1ce893b9 100644
--- a/detections/cloud/github_commit_in_develop.yml
+++ b/detections/cloud/github_commit_in_develop.yml
@@ -5,11 +5,10 @@ date: '2021-09-01'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a pushed or commit to develop branch.
-  This is to avoid unwanted modification to develop without a review to the changes.
-  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
-  of course in some cases admin of the project may did a changes directly to master
-  branch
+description: This search is to detect a pushed or commit to develop branch. This is
+  to avoid unwanted modification to develop without a review to the changes. Ideally
+  in terms of devsecops the changes made in a branch and do a PR for review. of course
+  in some cases admin of the project may did a changes directly to master branch
 search: '`github` branches{}.name = main OR branches{}.name = develop |  stats count
   min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email
   commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
@@ -48,3 +47,4 @@ tags:
   - _time
   risk_score: 9
   security_domain: endpoint
+  automated_detection_testing: passed

From aa834d87ba199d1f051aa09980024c6e72dab992 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-101-253>
Date: Wed, 1 Sep 2021 09:49:38 +0000
Subject: [PATCH 18/21] Added detection testing service results inGitHub
 Dependabot Alert

---
 detections/cloud/github_dependabot_alert.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml
index f30cfa4c01..7a2bdc59b3 100644
--- a/detections/cloud/github_dependabot_alert.yml
+++ b/detections/cloud/github_dependabot_alert.yml
@@ -6,12 +6,11 @@ author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel: []
 description: This search looks for Dependabot Alerts in Github logs.
-search: '`github` alert.id=* action=create 
-  | rename repository.full_name as repository, repository.html_url as repository_url
-  | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name 
-  alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in 
-  alert.severity repository repository_url
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`github` alert.id=* action=create | rename repository.full_name as repository,
+  repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
+  as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
+  alert.external_identifier alert.external_reference alert.fixed_in alert.severity
+  repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `github_dependabot_alert_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.

From dcbc0f95ad738b50a31b1b9d5965dd5e0bb163f4 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 1 Sep 2021 13:56:23 +0200
Subject: [PATCH 19/21] github detection

---
 .../github_pull_request_from_unknown_user.yml | 64 +++++++++++++++++++
 macros/github_known_users.yml                 |  3 +
 ...ub_pull_request_from_unknown_user.test.yml | 12 ++++
 3 files changed, 79 insertions(+)
 create mode 100644 detections/cloud/github_pull_request_from_unknown_user.yml
 create mode 100644 macros/github_known_users.yml
 create mode 100644 tests/cloud/github_pull_request_from_unknown_user.test.yml

diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml
new file mode 100644
index 0000000000..c7eaf731f3
--- /dev/null
+++ b/detections/cloud/github_pull_request_from_unknown_user.yml
@@ -0,0 +1,64 @@
+name: GitHub Pull Request from Unknown User
+id: 9d7b9100-8878-4404-914e-ca5e551a641e
+version: 1
+date: '2021-09-01'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search looks for Pull Request from unknown user.
+search: '`github` check_suite.pull_requests{}.id=* 
+  | stats count by check_suite.head_commit.author.name check_suite.pull_requests{}.base.repo.name 
+  check_suite.pull_requests{}.head.ref check_suite.head_commit.message 
+  | rename check_suite.head_commit.author.name as user check_suite.pull_requests{}.base.repo.name as repository 
+  check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message 
+  | search NOT `github_known_users`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `github_pull_request_from_unknown_user_filter`'
+how_to_implement: You must index GitHub logs. You can follow the url in reference
+  to onboard GitHub logs.
+known_false_positives: unknown
+references:
+- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: GitHub
+  cis20:
+  - CIS 13
+  confidence: 90
+  impact: 30
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Vulnerabilities found in packages used by GitHub repository $repository$
+  mitre_attack_id:
+  - T1195.001
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repository
+    type: System
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  - alert.id
+  - repository.full_name
+  - repository.html_url
+  - action
+  - alert.affected_package_name
+  - alert.affected_range
+  - alert.created_at
+  - alert.external_identifier
+  - alert.external_reference
+  - alert.fixed_in
+  - alert.severity
+  risk_score: 27
+  security_domain: network
+  
\ No newline at end of file
diff --git a/macros/github_known_users.yml b/macros/github_known_users.yml
new file mode 100644
index 0000000000..8350f6bae0
--- /dev/null
+++ b/macros/github_known_users.yml
@@ -0,0 +1,3 @@
+definition: user IN (user_names_here)
+description: specify the user allowed to create PRs in Github projects.
+name: github_known_users
diff --git a/tests/cloud/github_pull_request_from_unknown_user.test.yml b/tests/cloud/github_pull_request_from_unknown_user.test.yml
new file mode 100644
index 0000000000..32d4f347cf
--- /dev/null
+++ b/tests/cloud/github_pull_request_from_unknown_user.test.yml
@@ -0,0 +1,12 @@
+name: GitHub Pull Request from Unknown User Unit Test
+tests:
+- name: GitHub Pull Request from Unknown User
+  file: cloud/github_pull_request_from_unknown_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-365d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: github_pull_request.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json
+    sourcetype: aws:firehose:json
+    source: github

From 18835c540b740ac43cf5aa94d3bb002107218bc7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-40-243>
Date: Wed, 1 Sep 2021 12:16:41 +0000
Subject: [PATCH 20/21] Added detection testing service results inGitHub Pull
 Request from Unknown User

---
 .../github_pull_request_from_unknown_user.yml  | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml
index c7eaf731f3..456afb76ef 100644
--- a/detections/cloud/github_pull_request_from_unknown_user.yml
+++ b/detections/cloud/github_pull_request_from_unknown_user.yml
@@ -6,14 +6,12 @@ author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel: []
 description: This search looks for Pull Request from unknown user.
-search: '`github` check_suite.pull_requests{}.id=* 
-  | stats count by check_suite.head_commit.author.name check_suite.pull_requests{}.base.repo.name 
-  check_suite.pull_requests{}.head.ref check_suite.head_commit.message 
-  | rename check_suite.head_commit.author.name as user check_suite.pull_requests{}.base.repo.name as repository 
-  check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message 
-  | search NOT `github_known_users`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `github_pull_request_from_unknown_user_filter`'
+search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
+  check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
+  check_suite.head_commit.message | rename check_suite.head_commit.author.name as
+  user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
+  as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.
 known_false_positives: unknown
@@ -61,4 +59,6 @@ tags:
   - alert.severity
   risk_score: 27
   security_domain: network
-  
\ No newline at end of file
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_pull_request/github_pull_request.json

From 05cfcf6d7a4ed668ce1f2939ba1c57b2ad679ee2 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 1 Sep 2021 14:40:01 +0200
Subject: [PATCH 21/21] devsec3

---
 detections/cloud/github_commit_in_develop.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml
index 2b1ce893b9..8478cdca7f 100644
--- a/detections/cloud/github_commit_in_develop.yml
+++ b/detections/cloud/github_commit_in_develop.yml
@@ -48,3 +48,5 @@ tags:
   risk_score: 9
   security_domain: endpoint
   automated_detection_testing: passed
+
+