splunk-security_content/docs/_posts/2021-09-01-github_dependabot_alert.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
GitHub Dependabot Alert	Compromise Software Dependencies and Development Tools , Supply Chain Compromise	Cloud	2021-09-01	true		Compromise Software Dependencies and Development Tools Supply Chain Compromise Initial Access Initial Access Splunk Enterprise Splunk Enterprise Security Splunk Cloud

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search looks for Dependabot Alerts in Github logs.

• Type: Anomaly

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2021-09-01

• Author: Patrick Bareiss, Splunk

• ID: 05032b04-4469-4034-9df7-05f607d75cba

Annotations

ATT&CK

ID	Technique	Tactic
T1195.001	Compromise Software Dependencies and Development Tools	Initial Access

| T1195 | Supply Chain Compromise | Initial Access |

Kill Chain Phase

• Actions on Objectives

NIST

• PR.DS
• PR.AC
• DE.CM

CIS20

• CIS 13

CVE

Search

`github` alert.id=* action=create 
| rename repository.full_name as repository, repository.html_url as repository_url sender.login as user 
| stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user 
| eval phase="code" 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `github_dependabot_alert_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime
• github

Note that github_dependabot_alert_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required field

• _time
• alert.id
• repository.full_name
• repository.html_url
• action
• alert.affected_package_name
• alert.affected_range
• alert.created_at
• alert.external_identifier
• alert.external_reference
• alert.fixed_in
• alert.severity

How To Implement

You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.

Known False Positives

unknown

Associated Analytic story

• Dev Sec Ops

RBA

Risk Score	Impact	Confidence	Message
27.0	30	90	Vulnerabilities found in packages used by GitHub repository repository

Reference

• https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json

source | version: 1