From c2c125d7d72caf52df7aef4860a8260d48ef3f3d Mon Sep 17 00:00:00 2001 From: leftrightleft Date: Tue, 26 Apr 2022 16:09:46 -0700 Subject: [PATCH 1/6] feat: Add MTTR to code scanning dashboard --- .../data/ui/views/code_scanning_overview.xml | 56 ++++++++++++------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml index 9522135..fc09d0e 100644 --- a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml +++ b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml @@ -1,8 +1,8 @@ -
+ - `github_webhooks` (eventtype="GitHub::CodeScanning" OR eventtype="GitHub::Push") | eval action='action', tool=if(isnotnull('alert.tool.name'),'alert.tool.name','unknown'), repository=if(isnotnull('repository.name'),'repository.name','unknown'), severity=if(isnotnull('alert.rule.security_severity_level'),'alert.rule.security_severity_level','none'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), received_time='_time', alert_url=if(isnotnull('alert.html_url'),'alert.html_url','unknown'), eventtype='eventtype', created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), duration=received_time - created, duration_str=tostring(avg(duration), "duration") + `github_webhooks` (eventtype="GitHub::CodeScanning" OR eventtype="GitHub::Push") | eval action='action', tool=if(isnotnull('alert.tool.name'),'alert.tool.name','unknown'), repository=if(isnotnull('repository.name'),'repository.name','unknown'), severity=if(isnotnull('alert.rule.security_severity_level'),'alert.rule.security_severity_level','none'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), received_time='_time', alert_url=if(isnotnull('alert.html_url'),'alert.html_url','unknown'), eventtype='eventtype', created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), resolved_at=case('alert.dismissed_at' != "null", 'alert.dismissed_at', isnotnull('alert.fixed_at'), 'alert.fixed_at', isnotnull('alert.resolved_at'),'alert.resolved_at', 1=1, _time), duration = toString(round(strptime(resolved_at, "%Y-%m-%dT%H:%M:%S") - strptime(create_time, "%Y-%m-%dT%H:%M:%S"))), duration_str=tostring(avg(duration), "duration") $timeTkn.earliest$ $timeTkn.latest$ @@ -46,62 +46,78 @@ + Average Resolution Time (MTTR) + + + | search eventtype="GitHub::CodeScanning" (action=fixed OR action=closed_by_user) tool=$tool_name$ repository=$repoTkn$ +| eval action=action, , repository=if(isnotnull('repository.name'),'repository.name','unknown') +| eval age = avg(duration) +| appendpipe [ stats avg(age) as totalTime ] +| eval mttr = toString(round(totalTime), "duration"), clean_mttr = replace (mttr , "\+" , " days, ") +| stats max(clean_mttr) + + + + + + + + Created - Created | search tool=$tool_name$ repository=$repoTkn$ action="created" | stats count - + + Fixed - Fixed | search tool=$tool_name$ repository=$repoTkn$ action="fixed" | stats count - + + Reopened - Reopened | search tool=$tool_name$ repository=$repoTkn$ action="reopened" | stats count - + + Alert Found/Fixed Ratio - Alert Found/Fixed Ratio | search tool=$tool_name$ repository=$repoTkn$ (action=created OR action=fixed) -| timechart count(_raw) by action +| timechart count(_raw) by action | accum created -| accum fixed -| rename created as "Found" +| accum fixed +| rename created as "Found" | rename fixed as "Fixed" - + + Commit/Alert Ratio - Commit/Alert Ratio | search (eventtype="GitHub::Push" repository=$repoTkn$) OR ((action=created OR action=reopened) tool=$tool_name$ repository=$repoTkn$ ) | timechart count(_raw) by eventtype @@ -122,8 +138,8 @@ + New Alerts by Tool - New Alerts by Tool | search tool=$tool_name$ repository=$repoTkn$ (action=created OR action=appeared_in_branch) | timechart count(_raw) by tool @@ -141,8 +157,9 @@ Fixed Alerts | search (action=fixed OR action=closed_by_user) repository=$repoTkn$ tool=$tool_name$ -| table repository, tool, alert_url,duration_str -| rename repository AS "Repository" duration_str AS "Time to Resolution",tool AS "Tool", alert_url AS "Alert URL" +|eval clean_duration = replace (duration_str , "\+" , " days, ") +| table repository, tool, alert_url,clean_duration +| rename repository AS "Repository" clean_duration AS "Time to Resolution",tool AS "Tool", alert_url AS "Alert URL" | sort -"Time to Resolution" @@ -157,11 +174,8 @@ | search (action=created OR action=reopened) repository=$repoTkn$ tool=$tool_name$ | chart usenull=f count over repository by severity + - - - - From 337d64e2390873bd40915780f026759b16dc3c14 Mon Sep 17 00:00:00 2001 From: leftrightleft Date: Wed, 27 Apr 2022 12:42:01 -0700 Subject: [PATCH 2/6] change title to mttr --- .../default/data/ui/views/code_scanning_overview.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml index fc09d0e..7d92a0b 100644 --- a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml +++ b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml @@ -46,7 +46,7 @@ - Average Resolution Time (MTTR) + Mean Time to Resolution (MTTR) | search eventtype="GitHub::CodeScanning" (action=fixed OR action=closed_by_user) tool=$tool_name$ repository=$repoTkn$ From 2f6a38b8a12c5292cc1b746edd2afdef447d1fc4 Mon Sep 17 00:00:00 2001 From: leftrightleft Date: Wed, 27 Apr 2022 13:23:54 -0700 Subject: [PATCH 3/6] mttr to secret scanning dashboard --- .../ui/views/secret_scanning_overview.xml | 71 +++++++++++++------ 1 file changed, 48 insertions(+), 23 deletions(-) diff --git a/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml b/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml index 5fc7164..ef9c48f 100644 --- a/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml +++ b/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml @@ -1,8 +1,8 @@ - + - `github_webhooks` eventtype="GitHub::SecretScanning" | eval action='action', enterprise=if(isnotnull('enterprise.name'),'enterprise.name','unknown'), organization=if(isnotnull('organization.login'),'organization.login','unknown'), repository=if(isnotnull('repository.name'),'repository.name','unknown'), secret_type=if(isnotnull('alert.secret_type'),'alert.secret_type','unknown'), resolution=if(isnotnull('alert.resolution'),'alert.resolution','unknown'), resolved_at=if(isnotnull('alert.resolved_at'),'alert.resolved_at','unknown'), resolved_by=if(isnotnull('alert.resolved_by.login'),'alert.resolved_by.login','unknown') + `github_webhooks` eventtype="GitHub::SecretScanning" | eval action='action', enterprise=if(isnotnull('enterprise.name'),'enterprise.name','unknown'), organization=if(isnotnull('organization.login'),'organization.login','unknown'), repository=if(isnotnull('repository.name'),'repository.name','unknown'), secret_type=if(isnotnull('alert.secret_type'),'alert.secret_type','unknown'), resolution=if(isnotnull('alert.resolution'),'alert.resolution','unknown'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), resolved_at=case('alert.dismissed_at' != "null", 'alert.dismissed_at', isnotnull('alert.fixed_at'), 'alert.fixed_at', isnotnull('alert.resolved_at'),'alert.resolved_at', 1=1, _time), duration = toString(round(strptime(resolved_at, "%Y-%m-%dT%H:%M:%S") - strptime(create_time, "%Y-%m-%dT%H:%M:%S"))), duration_str=tostring(avg(duration), "duration"),'alert.resolved_at','unknown'), resolved_by=if(isnotnull('alert.resolved_by.login'),'alert.resolved_by.login','unknown'), url='alert.html_url' $timeTkn.earliest$ $timeTkn.latest$ @@ -59,6 +59,22 @@ + + + Mean Time To Resolution (MTTR) + + | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ action="resolved" + | eval age = avg(duration) + | appendpipe [ stats avg(age) as totalTime ] + | eval mttr = toString(round(totalTime), "duration"), clean_mttr = replace (mttr , "\+" , " days, ") + | stats max(clean_mttr) + + + + + + + Found Secrets @@ -66,7 +82,7 @@ | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ action="created" | stats count - + @@ -78,19 +94,32 @@ | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ action="resolved" | stats count - + + + + + + Secrets by Type + + | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ action="created" | chart count by secret_type + + + + + + - Secret Types + Secrets by Repository - | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ | chart count by secret_type + | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ action="created" | chart count by repository - + @@ -98,17 +127,17 @@ Secrets Found/Fixed Ratio | search repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ (action=created OR action=resolved) -| timechart count(_raw) by action +| timechart count(_raw) by action | accum created -| accum resolved -| rename created as "Found" +| accum resolved +| rename created as "Found" | rename resolved as "Fixed" - + @@ -117,12 +146,11 @@ Fixed Secrets - | search action=resolved repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ | table secret_type, organization, repository, resolution, resolved_by, _time - | rename secret_type as "Secret Type" - | rename organization as "Organization" - | rename repository as "Repository" - | rename resolution as "Resolution" - | rename resolved_by as "Resolved By" + | search action=resolved repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ +| eval mttr = toString(round(duration), "duration"), clean_mttr = replace (mttr , "\+" , " days, ") +| table secret_type, organization, repository, resolution, resolved_by, clean_mttr +| rename secret_type as "Secret Type", organization as "Organization", repository as "Repository", resolution as "Resolution", resolved_by as "Resolved By", clean_mttr as "Time to Resolution" + @@ -134,15 +162,12 @@
Found Secrets - | search action=created repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ | table secret_type, organization, repository, action, _time - | rename secret_type as "Secret Type" - | rename organization as "Organization" - | rename repository as "Repository" - | rename action as "Action" + | search action=created repository=$repoTkn$ organization=$orgTkn$ secret_type=$secret_type$ | table secret_type, organization, repository, url, create_time + | rename secret_type as "Secret Type", organization as "Organization", repository as "Repository", url as "URL", create_time as "Created At"
-
+ \ No newline at end of file From 1833093816d8248daae83dc9cc86b4a6d8fbc0f5 Mon Sep 17 00:00:00 2001 From: leftrightleft Date: Wed, 27 Apr 2022 18:41:28 -0700 Subject: [PATCH 4/6] mttr to Dependabot --- .../data/ui/views/dependabot_alerts.xml | 54 +++++++++++-------- 1 file changed, 31 insertions(+), 23 deletions(-) diff --git a/github_app_for_splunk/default/data/ui/views/dependabot_alerts.xml b/github_app_for_splunk/default/data/ui/views/dependabot_alerts.xml index d586fb1..3496568 100644 --- a/github_app_for_splunk/default/data/ui/views/dependabot_alerts.xml +++ b/github_app_for_splunk/default/data/ui/views/dependabot_alerts.xml @@ -1,8 +1,8 @@ -
+ - `github_webhooks` (eventtype="GitHub::VulnerabilityAlert" OR eventtype="GitHub::Push") | eval action='action', repository=if(isnotnull('repository.name'),'repository.name','unknown'), severity=if(isnotnull('alert.severity'),'alert.severity','none'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), received_time='_time', alert_url=if(isnotnull('alert.external_reference'),'alert.external_reference','unknown'), eventtype='eventtype', created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), duration=received_time - created, duration_str=tostring(avg(duration), "duration") + `github_webhooks` eventtype="GitHub::VulnerabilityAlert" | eval action='action', repository=if(isnotnull('repository.name'),'repository.name','unknown'), severity=if(isnotnull('alert.severity'),'alert.severity','none'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), received_time='_time', alert_url=if(isnotnull('alert.external_reference'),'alert.external_reference','unknown'), eventtype='eventtype', created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), resolved_at=case('alert.dismissed_at' != "null", 'alert.dismissed_at', isnotnull('alert.fixed_at'), 'alert.fixed_at', isnotnull('alert.resolved_at'),'alert.resolved_at', 1=1, _time), duration = toString(round(strptime(resolved_at, "%Y-%m-%dT%H:%M:%S") - strptime(create_time, "%Y-%m-%dT%H:%M:%S"))), duration_str=tostring(avg(duration), "duration") $timeTkn.earliest$ $timeTkn.latest$ @@ -17,7 +17,7 @@ - + All * * @@ -45,6 +45,23 @@ + + + Mean Time to Resolution (MTTR) + + | search severity=$severity_label$ repository=$repoTkn$ action="resolve" + | eval age = avg(duration) + | appendpipe [ stats avg(age) as totalTime ] + | eval mttr = toString(round(totalTime), "duration"), clean_mttr = replace (mttr , "\+" , " days, ") + | stats max(clean_mttr) + + + + + + + + Created @@ -52,7 +69,7 @@ | search severity=$severity_label$ repository=$repoTkn$ action="create" | stats count - + @@ -64,7 +81,7 @@ | search severity=$severity_label$ repository=$repoTkn$ (action="resolve") | stats count - + @@ -75,7 +92,7 @@ | search severity=$severity_label$ repository=$repoTkn$ (action="dismiss") | stats count - + @@ -97,29 +114,20 @@ - + - Commit/Alert Ratio + Vulnerabilities by Repo - | search (eventtype="GitHub::Push" repository=$repoTkn$) OR ((action=create) severity=$severity_label$ repository=$repoTkn$ ) -| timechart count(_raw) by eventtype -| accum "GitHub::Push" -| accum "GitHub::VulnerabilityAlert" -| rename GitHub::Push as "Pushes" -| rename GitHub::VulnerabilityAlert as "Dependabot Alerts" -| fields - err0r + | search severity=$severity_label$ repository=$repoTkn$ action=create | chart count by repository + - - - - - + - + @@ -132,7 +140,7 @@ - + @@ -170,4 +178,4 @@ -
+ \ No newline at end of file From f9939ce774b6a771b3f29828329c4a5868a830a3 Mon Sep 17 00:00:00 2001 From: Dan Shanahan Date: Mon, 2 May 2022 17:07:21 -0700 Subject: [PATCH 5/6] Update code_scanning_overview.xml --- .../default/data/ui/views/code_scanning_overview.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml index 7d92a0b..eeaab84 100644 --- a/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml +++ b/github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml @@ -1,4 +1,4 @@ -
+ From 6a94df0478651b104f82ca876eec2f4946573672 Mon Sep 17 00:00:00 2001 From: Dan Shanahan Date: Mon, 2 May 2022 17:10:35 -0700 Subject: [PATCH 6/6] Update secret_scanning_overview.xml --- .../default/data/ui/views/secret_scanning_overview.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml b/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml index ef9c48f..1cdf640 100644 --- a/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml +++ b/github_app_for_splunk/default/data/ui/views/secret_scanning_overview.xml @@ -1,4 +1,4 @@ - + @@ -170,4 +170,4 @@ - \ No newline at end of file +