mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
19 lines
1.1 KiB
YAML
19 lines
1.1 KiB
YAML
name: Dev Sec Ops
|
|
id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e
|
|
version: 2
|
|
creation_date: '2021-08-18'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
status: production
|
|
description: This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
|
|
narrative: DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
|
|
references:
|
|
- https://www.redhat.com/en/topics/devops/what-is-devsecops
|
|
category:
|
|
- Cloud Security
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Security Monitoring
|