Skip to content

Commit e11c55b

Browse files
author
Patrick Bareiss
committed
New GitHub Enterprise detections
1 parent 416c239 commit e11c55b

File tree

3 files changed

+111
-0
lines changed

3 files changed

+111
-0
lines changed

‎data_sources/github.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: GitHub
2+
id: 8a4d656f-8801-4a2c-ae10-553d2696a59f
3+
version: 1
4+
date: '2025-01-15'
5+
author: Patrick Bareiss, Splunk
6+
description: Data source object for GitHub Enterprise logs
7+
source: github
8+
sourcetype: github:cloud:audit
9+
supported_TA:
10+
- name: Splunk Add-on for Github
11+
url: https://splunkbase.splunk.com/app/6254
12+
version: 3.1.0
13+
fields:
14+
- _document_id
15+
- action
16+
- actor
17+
- actor_id
18+
- actor_is_bot
19+
- business
20+
- business_id
21+
- created_at
22+
- operation_type
23+
- org
24+
- org_id
25+
- public_repo
26+
- repo
27+
- repo_id
28+
- request_access_security_header
29+
- user
30+
- user_agent
31+
- user_id
32+
example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }'

‎detections/cloud/github_disable_dependabot.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: GitHub Disable Dependabot
2+
id: 787dd1c1-eb3a-4a31-8e8c-2ad24b214bc8
3+
version: 1
4+
date: '2025-01-14'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when a user disables Dependabot security features within a GitHub repository.
9+
Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub
10+
Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker
11+
attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities
12+
that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may
13+
be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities
14+
remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.
15+
data_source:
16+
- GitHub
17+
search: '`github_enterprise` action=repository_vulnerability_alerts.disable OR vendor_action=repository_vulnerability_alerts.disable
18+
| fillnull
19+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user, user_agent, user_id, src, action, vendor_action
20+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
21+
| `github_disable_dependabot_filter`'
22+
how_to_implement: You must ingest GitHub Enterprise logs using the Splunk Add-on for GitHub https://splunkbase.splunk.com/app/6254 .
23+
known_false_positives: unknown
24+
references:
25+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
26+
drilldown_searches:
27+
- name: View the detection results for - "$user$"
28+
search: '%original_detection_search% | search user = "$user$"'
29+
earliest_offset: $info_min_time$
30+
latest_offset: $info_max_time$
31+
- name: View risk events for the last 7 days for - "$user$"
32+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
tags:
36+
analytic_story:
37+
- GitHub Malicious Activity
38+
asset_type: GitHub
39+
confidence: 90
40+
impact: 30
41+
message: Dependabot security features are disabled in repository $repo$ by $user$
42+
mitre_attack_id:
43+
- T1562.001
44+
observable:
45+
- name: user
46+
type: User
47+
role:
48+
- Victim
49+
product:
50+
- Splunk Enterprise
51+
- Splunk Enterprise Security
52+
- Splunk Cloud
53+
required_fields:
54+
- actor
55+
- actor_id
56+
- actor_ip
57+
- actor_is_bot
58+
- actor_location.country_code
59+
- business
60+
- business_id
61+
- org
62+
- org_id
63+
- repo
64+
- repo_id
65+
- user
66+
- user_agent
67+
- user_id
68+
risk_score: 27
69+
security_domain: network
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_dependabot/github.json
74+
source: github
75+
sourcetype: github:cloud:audit

‎macros/github_enterprise.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
definition: sourcetype=github:cloud:audit
2+
description: customer specific splunk configurations(eg- index, source, sourcetype).
3+
Replace the macro definition with configurations for your Splunk Environment.
4+
name: github_enterprise

0 commit comments

Comments
 (0)