ID | Technique | Tactic |
---|---|---|
T1195.001 | Compromise Software Dependencies and Development Tools | Initial Access |
T1195 | Supply Chain Compromise | Initial Access |
Detection: GitHub Dependabot Alert
Description
The following analytic identifies the creation of GitHub Dependabot alerts, which indicate potential vulnerabilities in the codebase. It detects this activity by searching for logs with the "create" action and analyzing fields such as affected package, severity, and fixed version. This detection is significant for a SOC because it helps identify and address security risks in the codebase proactively. If confirmed malicious, these vulnerabilities could be exploited by attackers to gain unauthorized access or cause breaches, leading to potential data loss or system compromise.
Search
1`github` alert.id=* action=create
2| rename repository.full_name as repository, repository.html_url as repository_url sender.login as user
3| stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user
4| eval phase="code"
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `github_dependabot_alert_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
GitHub | AWS | 'aws:firehose:json' |
'github' |
N/A |
Macros Used
Name | Value |
---|---|
github | sourcetype=aws:firehose:json |
github_dependabot_alert_filter | search * |
github_dependabot_alert_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
Known False Positives
unknown
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Vulnerabilities found in packages used by GitHub repository $repository$ | 27 | 30 | 90 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | github |
aws:firehose:json |
Integration | ✅ Passing | Dataset | github |
aws:firehose:json |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2