Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Advanced Security Overview - enable DrillDown deeplink to security alerts #41

Merged
merged 2 commits into from
Apr 28, 2022
Merged

Advanced Security Overview - enable DrillDown deeplink to security alerts #41

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
71ac32a
Fix broken DrillDown deeplink to security alerts
felickz Apr 27, 2022
a7eb461
decode not needed
felickz Apr 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions github_app_for_splunk/default/data/ui/views/security_alert_overview.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,9 @@
<query>
index=gh_vuln OR (`github_webhooks` alert.created_at=*)
| eval type=case((eventtype="GitHub::CodeScanning"), "Code Scanning Alert", (eventtype="GitHub::VulnerabilityAlert"), "Dependabot Alert", (eventtype="GitHub::SecretScanning"), "Secret Scanning Alert")
| eval reason=case((type="Dependabot Alert"),'alert.affected_package_name',(type="Code Scanning Alert"), 'alert.rule.name', (type="Secret Scanning Alert"), 'alert.secret_type'), id=case((type="Dependabot Alert"),'alert.external_identifier',(type="Code Scanning Alert"), 'alert.rule.id', (type="Secret Scanning Alert"), 'alert.number'), severity=case((type="Dependabot Alert"),'alert.severity',(type="Code Scanning Alert"), 'alert.rule.security_severity_level', (type="Secret Scanning Alert"), "high")
| stats latest(action) as status, earliest(alert.created_at) as created_at, latest(alert.number) as number by repository.full_name, reason, id, type, severity
| eval url=case((eventtype="GitHub::CodeScanning"), 'alert.html_url', (eventtype="GitHub::VulnerabilityAlert"), 'repository.html_url'+"/security/dependabot/"+'alert.number', (eventtype="GitHub::SecretScanning"), 'alert.html_url')
| eval reason=case((type="Dependabot Alert"),'alert.affected_package_name',(type="Code Scanning Alert"), 'alert.rule.name', (type="Secret Scanning Alert"), 'alert.secret_type'), id=case((type="Dependabot Alert"),'alert.external_identifier',(type="Code Scanning Alert"), 'alert.rule.id', (type="Secret Scanning Alert"), 'alert.number'), severity=case((type="Dependabot Alert"),'alert.severity',(type="Code Scanning Alert"), 'alert.rule.security_severity_level', (type="Secret Scanning Alert"), "high"), repository = 'repository.full_name'
| stats latest(action) as status, earliest(alert.created_at) as created_at, latest(alert.number) as number by repository, reason, id, type, severity, url
| eval source=type
| eval age = toString(round(now() - strptime(created_at, "%Y-%m-%dT%H:%M:%S")),"Duration")
| search severity IN("*") status IN("*") type IN("*")
Expand Down Expand Up @@ -88,7 +89,7 @@
<title>Open Alerts By Repository</title>
<chart>
<search base="baseSearch">
<query>| search status IN("create","created") | stats count by repository.full_name</query>
<query>| search status IN("create","created") | stats count by repository</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
Expand Down Expand Up @@ -239,11 +240,9 @@
<search base="baseSearch">
<query>|search severity IN($severityTkn$) status IN($statusTkn$) type IN($typeTkn$) | sort -age</query>
</search>
<fields>repository.full_name, reason, id, type,severity,status, created_at, age</fields>
<fields>repository, reason, id, type,severity,status, created_at, age</fields>
<drilldown target="_blank">
<link>
https://github.com/$row.repository.full_name|n$/security/$row.source$/$row.number$
</link>
<link>$row.url|n$</link>
</drilldown>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
Expand Down