Narrow CodeScanning eventtypes again

Narrow CodeScanning eventtype definition. In PR splunk#35 @leftrightleft narrowed the eventtype for CodeScanning events but then was (accidently?) reverted by splunk#37. This change narrows the eventtype again.
akinnane · Mar 10, 2023 · 664669a · 664669a
1 parent 2e5a5d4
commit 664669a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/github_app_for_splunk/default/eventtypes.conf b/github_app_for_splunk/default/eventtypes.conf
@@ -5,7 +5,7 @@ search = `github_webhooks` ref_type=branch
 search = `github_source` action=* sourcetype="github:enterprise:audit" OR sourcetype="github_audit"
 
 [GitHub::CodeScanning]
-search = `github_webhooks` action IN ("appeared_in_branch", "closed_by_user", "created", "fixed", "reopened", "reopened_by_user") "alert.created_at"=*
+search = `github_webhooks` action IN ("appeared_in_branch", "closed_by_user", "created", "fixed", "reopened", "reopened_by_user") "commit_oid"=*
 
 [GitHub::CodeVulnerability]
 search = `github_webhooks` (eventtype="GitHub::CodeScanning") "alert.html_url"="*/security/code-scanning/*"