mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
55 lines
3.4 KiB
YAML
55 lines
3.4 KiB
YAML
name: GitHub Dependabot Alert
|
|
id: 05032b04-4469-4034-9df7-05f607d75cba
|
|
version: 6
|
|
creation_date: '2021-09-01'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
status: removed
|
|
type: Anomaly
|
|
description: The following analytic identifies the creation of GitHub Dependabot alerts, which indicate potential vulnerabilities in the codebase. It detects this activity by searching for logs with the "create" action and analyzing fields such as affected package, severity, and fixed version. This detection is significant for a SOC because it helps identify and address security risks in the codebase proactively. If confirmed malicious, these vulnerabilities could be exploited by attackers to gain unauthorized access or cause breaches, leading to potential data loss or system compromise.
|
|
data_source:
|
|
- GitHub Webhooks
|
|
search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`'
|
|
how_to_implement: You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$repository$"
|
|
search: '%original_detection_search% | search repository = "$repository$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$repository$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$repository$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
rba:
|
|
message: Vulnerabilities found in packages used by GitHub repository $repository$
|
|
risk_objects:
|
|
- field: repository
|
|
type: other
|
|
score: 27
|
|
threat_objects: []
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: GitHub
|
|
mitre_attack_id:
|
|
- T1195.001
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: network
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.001/github_security_advisor_alert/github_security_advisor_alert.json
|
|
sourcetype: aws:firehose:json
|
|
source: github
|
|
deprecation_info:
|
|
reason: Detection deprecated as it no longer effectively identifies the intended malicious activity
|
|
removed_in_version: 5.4.0
|
|
replacement_content:
|
|
- GitHub Enterprise Disable Dependabot
|