From 042f2dc3642505fe7348c00225a0286cc3b7748c Mon Sep 17 00:00:00 2001
From: leftrightleft
Date: Wed, 1 Dec 2021 15:57:26 -0800
Subject: [PATCH 01/16] feat: code scanning event type
---
github_app_for_splunk/default/eventtypes.conf | 3 +++
1 file changed, 3 insertions(+)
diff --git a/github_app_for_splunk/default/eventtypes.conf b/github_app_for_splunk/default/eventtypes.conf
index 71e1e06..aca0a21 100644
--- a/github_app_for_splunk/default/eventtypes.conf
+++ b/github_app_for_splunk/default/eventtypes.conf
@@ -27,3 +27,6 @@ search = `github_webhooks` action IN ("created","edited","moved","deleted") "pr
[GitHub::Workflow]
search = `github_webhooks` action IN ("queued","created","started","completed") workflow_job.id=*
+
+[GitHub::CodeScanning]
+search = `github_webhooks` action IN ("appeared_in_branch", "closed_by_user", "created", "fixed", "reopened", "reopened_by_user") "alert.created_at"=*
\ No newline at end of file
From c064d0afc38e8d18f53109879b7b5053bcf15914 Mon Sep 17 00:00:00 2001
From: leftrightleft
Date: Wed, 1 Dec 2021 15:58:00 -0800
Subject: [PATCH 02/16] feat: set datetime to current
---
github_app_for_splunk/default/props.conf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/github_app_for_splunk/default/props.conf b/github_app_for_splunk/default/props.conf
index 4edc247..b6fcbb1 100644
--- a/github_app_for_splunk/default/props.conf
+++ b/github_app_for_splunk/default/props.conf
@@ -29,7 +29,7 @@ disabled = false
pulldown_type = 1
[github_json]
-DATETIME_CONFIG =
+DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
TRUNCATE = 250000
From bb7eca1ebd212d1f8b35320c6c627868c9a0037a Mon Sep 17 00:00:00 2001
From: leftrightleft
Date: Wed, 1 Dec 2021 16:03:14 -0800
Subject: [PATCH 03/16] feat: add code scanning to the welcome page
---
.../default/data/ui/views/welcome_page.xml | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/github_app_for_splunk/default/data/ui/views/welcome_page.xml b/github_app_for_splunk/default/data/ui/views/welcome_page.xml
index 183c0d5..046ba8b 100644
--- a/github_app_for_splunk/default/data/ui/views/welcome_page.xml
+++ b/github_app_for_splunk/default/data/ui/views/welcome_page.xml
@@ -39,6 +39,9 @@
The "Enterprise Server Monitor" drop down has several dashboards that report on the health and performance of your GHES environment
"Audit" drop down works for GHES as well as GitHub.com audit logs
The Alerts menu item contains all GitHub recommended alerts
+ Audit Log Activity provides a highlevel overview of what activity is going on in GitHub.
+ Repository Audit lets you review changes to individual or groups of repositories
+ User Change Audit is the best place to review actions taken by or made to individual users.
@@ -55,13 +58,11 @@
}
-
Audit and Security
+
GitHub Advanced Security
- Security users will probably be most interested in the Audit dashboards
+ Customers of GitHub Advanced Security have access to enterprise security tooling such as Code Scanning, Secret Scanning, and Dependency Review.
- - Audit Log Activity provides a highlevel overview of what activity is going on in GitHub.
- - Repository Audit lets you review changes to individual or groups of repositories
- - User Change Audit is the best place to review actions taken by or made to individual users.
+ - The Code Scanning dashboard gives insight into the security posture of your GitHub Organization
@@ -85,7 +86,7 @@
GitHub has several ways to collect data from their services depending on your needs. Information is available within the App on how to collect different types of data from GitHub:
- Audit Log data is available through a Splunk Add-On
- - Rich commit and pull request data is available through GitHub Webhooks
+ - Rich commit, pull request, and Code Scanning data is available through GitHub Webhooks
From e2bf867db3fb4de7bfce8f6923dcbf8e674d78a5 Mon Sep 17 00:00:00 2001
From: leftrightleft
Date: Wed, 1 Dec 2021 16:09:01 -0800
Subject: [PATCH 04/16] feat: add code scanning webhook notes
---
.../default/data/ui/views/webhook_config.xml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/github_app_for_splunk/default/data/ui/views/webhook_config.xml b/github_app_for_splunk/default/data/ui/views/webhook_config.xml
index 80d4921..4a41155 100644
--- a/github_app_for_splunk/default/data/ui/views/webhook_config.xml
+++ b/github_app_for_splunk/default/data/ui/views/webhook_config.xml
@@ -64,6 +64,12 @@
Pull request reviews |
Pull request review submitted, edited, or dismissed. |
+
+ | GitHub::CodeScanning |
+ Code Scanning alerts |
+ Alert created, fixed, reopened, appeared in branch, closed by user, or reopened by user. |
+
+