Skip to content

Commit febbbd8

Browse files
derkkila-splunkderkkila-splunk
authored
Merge pull request #21 from leftrightleft/feat/code_scanning
Code Scanning Dashboard
2 parents 1927b61 + a4e0ae1 commit febbbd8

File tree

11 files changed

+226
-13
lines changed

11 files changed

+226
-13
lines changed

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This App is designed to work across multiple GitHub data sources however not all
77
The GitHub App for Splunk is designed to work with the following data sources:
88

99
* [GitHub Audit Log Monitoring Add-On For Splunk](./docs/ghe_audit_logs.MD): Audit logs from GitHub Enterprise Cloud.
10-
* [Github.com Webhooks](./docs/github_webhooks.MD): A select set of webhook events like Push, PullRequest, and Repo.
10+
* [Github.com Webhooks](./docs/github_webhooks.MD): A select set of webhook events like Push, PullRequest, Code Scanning and Repo.
1111
* [Github Enterprise Server Syslog Forwarder](./docs/ghes_syslog_setup.MD): Audit and Application logs from Github Enterprise Server.
1212
* [Github Enterprise Collectd monitoring](./docs/splunk_collectd_forwarding_for_ghes.MD): Performance and Infrastructure metrics from Github Enterprise Server.
1313

@@ -37,6 +37,9 @@ There is an *Integration Overview* dashboard listed under *Dashboards* that allo
3737
<details>
3838
<summary>Expand for screenshots</summary>
3939

40+
#### Code Scanning Alerts
41+
![Code Scanning Dashboard](./docs/images/code_scanning_dashboard.png)
42+
4043
#### Audit Log Dashboard
4144

4245
![Audit Log Dashboard](./docs/images/9F8E9A89-1203-4C0A-B227-C2FD1E17C8B0.jpg)

‎docs/github_webhooks.MD‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,10 @@ Once that is complete and webhooks are triggering, you'll want to update the mac
6464
<td>Pull request reviews</td>
6565
<td>Pull request review submitted, edited, or dismissed.</td>
6666
</tr>
67+
<tr>
68+
<td>GitHub::CodeScanning</td>
69+
<td>Code scanning alerts</td>
70+
<td>Alerts identified by CodeQL and other 3rd party/OSS scanning tools.</td>
71+
</tr>
72+
6773
</table>

‎docs/images/code_scanning_dashboard.png‎

423 KB
Loading

‎github_app_for_splunk/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
# GitHub App for Splunk
22

3-
The GitHub App for Splunk is a collection of out of the box dashboards and Splunk knowledge objects designed to give GitHub Admins and platform owners immediate visibility into GitHub.
3+
The GitHub App for Splunk is a collection of out of the box dashboards and Splunk knowledge objects designed to give GitHub Admins, platform owners, and Security Engineers immediate visibility into GitHub.
44

55
This App is designed to work across multiple GitHub data sources however not all all required. You may choose to only collect a certain set of data and the parts of this app that utilize that set will function, while those that use other data sources will not function correctly, so please only use the Dashboards that relate to the data you are collecting.
66

77
The GitHub App for Splunk is designed to work with the following data sources:
88

99
* [GitHub Audit Log Monitoring Add-On For Splunk](./docs/ghe_audit_logs.MD): Audit logs from GitHub Enterprise Cloud.
10-
* [Github.com Webhooks]((./docs/github_webhooks.MD)): A select set of webhook events like Push, PullRequest, and Repo.
10+
* [Github.com Webhooks]((./docs/github_webhooks.MD)): A select set of webhook events like Push, PullRequest, Repo, and Code Scanning alerts.
1111
* [GitHub Enterprise Server Syslog Forwarder](https://docs.github.com/en/enterprise-server@3.0/admin/user-management/monitoring-activity-in-your-enterprise/log-forwarding): Audit and Application logs from GitHub Enterprise Server.
1212
* [GitHub Enterprise Collectd monitoring](./docs/splunk_collectd_forwarding_for_ghes.MD): Performance and Infrastructure metrics from GitHub Enterprise Server.
1313

‎github_app_for_splunk/default/data/ui/nav/default.xml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@
88
<view name="repository_audit" />
99
<view name="user_audit" />
1010
</collection>
11-
<collection label="Security">
11+
<collection label="Advanced Security">
1212
<view name="security_alert_overview" />
13+
<view name="code_scanning_overview" />
1314
</collection>
1415
<collection label="Developer Insights">
1516
<view name="value_stream_analytics" />

‎github_app_for_splunk/default/data/ui/views/code_scanning_overview.xml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
<form theme="light">
2+
<label>Code Scanning Alerts</label>
3+
<search id="baseSearch">
4+
<query>
5+
`github_webhooks` (eventtype="GitHub::CodeScanning" OR eventtype="GitHub::Push") | eval action='action', tool=if(isnotnull('alert.tool.name'),'alert.tool.name','unknown'), repository=if(isnotnull('repository.name'),'repository.name','unknown'), severity=if(isnotnull('alert.rule.security_severity_level'),'alert.rule.security_severity_level','none'), create_time=if(isnotnull('alert.created_at'),'alert.created_at','unknown'), received_time='_time', alert_url=if(isnotnull('alert.html_url'),'alert.html_url','unknown'), eventtype='eventtype', created=strptime(create_time, "%Y-%m-%dT%H:%M:%S%Z"), duration=received_time - created, duration_str=tostring(avg(duration), "duration")
6+
</query>
7+
<earliest>$timeTkn.earliest$</earliest>
8+
<latest>$timeTkn.latest$</latest>
9+
<sampleRatio>1</sampleRatio>
10+
</search>
11+
<fieldset submitButton="false" autoRun="true">
12+
<input type="time" token="timeTkn" searchWhenChanged="true">
13+
<label>Time Range</label>
14+
<default>
15+
<earliest>-24h@h</earliest>
16+
<latest>now</latest>
17+
</default>
18+
</input>
19+
<input type="multiselect" token="tool_name" searchWhenChanged="true">
20+
<label>Tool</label>
21+
<fieldForLabel>tool</fieldForLabel>
22+
<fieldForValue>tool</fieldForValue>
23+
<valuePrefix>"</valuePrefix>
24+
<valueSuffix>"</valueSuffix>
25+
<search base="baseSearch">
26+
<query>| table tool | dedup tool</query>
27+
</search>
28+
<choice value="*">All</choice>
29+
<default>*</default>
30+
<initialValue>*</initialValue>
31+
</input>
32+
<input type="multiselect" token="repoTkn" searchWhenChanged="true">
33+
<label>Repositories</label>
34+
<choice value="*">All</choice>
35+
<default>*</default>
36+
<initialValue>*</initialValue>
37+
<valuePrefix>"</valuePrefix>
38+
<valueSuffix>"</valueSuffix>
39+
<delimiter>,</delimiter>
40+
<fieldForLabel>repository</fieldForLabel>
41+
<fieldForValue>repository</fieldForValue>
42+
<search base="baseSearch">
43+
<query>| dedup repository | table repository</query>
44+
</search>
45+
</input>
46+
</fieldset>
47+
<row>
48+
<panel>
49+
<single>
50+
<title>Created</title>
51+
<search base="baseSearch">
52+
<query>| search tool=$tool_name$ repository=$repoTkn$ action="created" | stats count</query>
53+
</search>
54+
<option name="drilldown">none</option>
55+
<option name="height">50</option>
56+
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
57+
<option name="refresh.display">progressbar</option>
58+
</single>
59+
</panel>
60+
<panel>
61+
<single>
62+
<title>Fixed</title>
63+
<search base="baseSearch">
64+
<query>| search tool=$tool_name$ repository=$repoTkn$ action="fixed" | stats count</query>
65+
</search>
66+
<option name="drilldown">none</option>
67+
<option name="height">50</option>
68+
<option name="refresh.display">progressbar</option>
69+
</single>
70+
</panel>
71+
<panel>
72+
<single>
73+
<title>Reopened</title>
74+
<search base="baseSearch">
75+
<query>| search tool=$tool_name$ repository=$repoTkn$ action="reopened" | stats count</query>
76+
</search>
77+
<option name="drilldown">none</option>
78+
<option name="height">50</option>
79+
<option name="refresh.display">progressbar</option>
80+
</single>
81+
</panel>
82+
</row>
83+
<row>
84+
<panel>
85+
<chart>
86+
<title>Alert Found/Fixed Ratio</title>
87+
<search base="baseSearch">
88+
<query>| search tool=$tool_name$ repository=$repoTkn$ (action=created OR action=fixed)
89+
| timechart count(_raw) by action
90+
| accum created
91+
| accum fixed
92+
| rename created as "Found"
93+
| rename fixed as "Fixed"</query>
94+
</search>
95+
<option name="charting.axisTitleX.visibility">collapsed</option>
96+
<option name="charting.chart">line</option>
97+
<option name="charting.drilldown">none</option>
98+
<option name="refresh.display">progressbar</option>
99+
<option name="height">150</option>
100+
</chart>
101+
</panel>
102+
<panel>
103+
<chart>
104+
<title>Commit/Alert Ratio</title>
105+
<search base="baseSearch">
106+
<query>| search (eventtype="GitHub::Push" repository=$repoTkn$) OR ((action=created OR action=reopened) tool=$tool_name$ repository=$repoTkn$ )
107+
| timechart count(_raw) by eventtype
108+
| accum "GitHub::Push"
109+
| accum "GitHub::CodeScanning"
110+
| rename GitHub::Push as "Pushes"
111+
| rename GitHub::CodeScanning as "Code Scanning Alerts"</query>
112+
</search>
113+
<option name="charting.axisTitleX.visibility">collapsed</option>
114+
<option name="charting.axisY.scale">log</option>
115+
<option name="charting.axisY2.enabled">1</option>
116+
<option name="charting.chart">line</option>
117+
<option name="charting.chart.overlayFields">DC_cumulative</option>
118+
<option name="charting.drilldown">none</option>
119+
<option name="charting.legend.mode">standard</option>
120+
<option name="height">150</option>
121+
<option name="refresh.display">progressbar</option>
122+
</chart>
123+
</panel>
124+
<panel>
125+
<chart>
126+
<title>New Alerts by Tool</title>
127+
<search base="baseSearch">
128+
<query>| search tool=$tool_name$ repository=$repoTkn$ (action=created OR action=appeared_in_branch) | timechart count(_raw) by tool</query>
129+
</search>
130+
<option name="charting.chart">column</option>
131+
<option name="charting.chart.stackMode">stacked</option>
132+
<option name="charting.drilldown">none</option>
133+
<option name="height">150</option>
134+
<option name="refresh.display">progressbar</option>
135+
</chart>
136+
</panel>
137+
</row>
138+
<row>
139+
<panel>
140+
<table>
141+
<title>Fixed Alerts</title>
142+
<search base="baseSearch">
143+
<query> | search (action=fixed OR action=closed_by_user) repository=$repoTkn$ tool=$tool_name$
144+
| table repository, tool, alert_url,duration_str
145+
| rename repository AS "Repository" duration_str AS "Time to Resolution",tool AS "Tool", alert_url AS "Alert URL"
146+
| sort -"Time to Resolution"
147+
</query>
148+
</search>
149+
<option name="drilldown">none</option>
150+
</table>
151+
</panel>
152+
</row>
153+
<row>
154+
<panel>
155+
<table>
156+
<title>Alerts by Severity</title>
157+
<search base="baseSearch">
158+
<query>| search (action=created OR action=reopened) repository=$repoTkn$ tool=$tool_name$ | chart usenull=f count over repository by severity</query>
159+
</search>
160+
<option name="drilldown">none</option>
161+
<format type="color" field="critical">
162+
<colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
163+
<scale type="minMidMax"></scale>
164+
</format>
165+
<format type="color" field="high">
166+
<colorPalette type="minMidMax" maxColor="#F8BE34" minColor="#FFFFFF"></colorPalette>
167+
<scale type="minMidMax"></scale>
168+
</format>
169+
<format type="color" field="medium">
170+
<colorPalette type="minMidMax" maxColor="#62B3B2" minColor="#FFFFFF"></colorPalette>
171+
<scale type="minMidMax"></scale>
172+
</format>
173+
</table>
174+
</panel>
175+
<panel>
176+
<table>
177+
<title>Alerts by Repo</title>
178+
<search base="baseSearch">
179+
<query>| search (action=created OR action=reopened) repository=$repoTkn$ tool=$tool_name$| chart usenull=f count over repository by tool</query>
180+
</search>
181+
<option name="drilldown">none</option>
182+
<option name="percentagesRow">false</option>
183+
<option name="refresh.display">progressbar</option>
184+
<option name="totalsRow">false</option>
185+
<format type="color" field="repository.name">
186+
<colorPalette type="minMidMax" maxColor="#53A051" minColor="#FFFFFF"></colorPalette>
187+
<scale type="minMidMax"></scale>
188+
</format>
189+
</table>
190+
</panel>
191+
</row>
192+
</form>

‎github_app_for_splunk/default/data/ui/views/security_alert_overview.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<form>
2-
<label>Security Alert Overview</label>
2+
<label>Advanced Security Overview</label>
33
<search id="baseSearch">
44
<query>
5-
index="github_webhook" alert.created_at=* | eval reason=if(isnotnull('alert.affected_package_name'),'alert.affected_package_name','alert.rule.name'), id=if(isnotnull('alert.external_identifier'),'alert.external_identifier','alert.rule.id'), severity=if(isnotnull('alert.severity'),'alert.severity','alert.rule.security_severity_level'), type=if(isnotnull('alert.external_identifier'),"vulnerability alert","code scanning alert") | stats latest(action) as status, earliest(alert.created_at) as created_at by repository.name, reason, id, type, severity | eval age = toString(round(now() - strptime(created_at, "%Y-%m-%dT%H:%M:%S")),"Duration")
5+
`github_webhooks` alert.created_at=* | eval reason=if(isnotnull('alert.affected_package_name'),'alert.affected_package_name','alert.rule.name'), id=if(isnotnull('alert.external_identifier'),'alert.external_identifier','alert.rule.id'), severity=if(isnotnull('alert.severity'),'alert.severity','alert.rule.security_severity_level'), type=if(isnotnull('alert.external_identifier'),"Dependabot Alert","Code Scanning Alert") | stats latest(action) as status, earliest(alert.created_at) as created_at by repository.name, reason, id, type, severity | eval age = toString(round(now() - strptime(created_at, "%Y-%m-%dT%H:%M:%S")),"Duration")
66
</query>
77
<earliest>$timeTkn.earliest$</earliest>
88
<latest>$timeTkn.latest$</latest>

‎github_app_for_splunk/default/data/ui/views/webhook_config.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@
6464
<td>Pull request reviews</td>
6565
<td>Pull request review submitted, edited, or dismissed.</td>
6666
</tr>
67+
<tr>
68+
<td>GitHub::CodeScanning</td>
69+
<td>Code Scanning alerts</td>
70+
<td>Alert created, fixed, reopened, appeared in branch, closed by user, or reopened by user.</td>
71+
</tr>
72+
6773
</table>
6874
</html>
6975
</panel>

‎github_app_for_splunk/default/data/ui/views/welcome_page.xml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@
3939
<li>The "Enterprise Server Monitor" drop down has several dashboards that report on the health and performance of your GHES environment</li>
4040
<li>"Audit" drop down works for GHES as well as GitHub.com audit logs</li>
4141
<li>The <a href="alerts">Alerts</a> menu item contains all GitHub recommended alerts</li>
42+
<li><a href="audit_log_activity">Audit Log Activity</a> provides a highlevel overview of what activity is going on in GitHub.</li>
43+
<li><a href="repository_audit">Repository Audit</a> lets you review changes to individual or groups of repositories </li>
44+
<li><a href="user_audit">User Change Audit</a> is the best place to review actions taken by or made to individual users.</li>
4245
</ol>
4346
</p>
4447
</div>
@@ -55,13 +58,12 @@
5558
}
5659
</style>
5760
<div>
58-
<h2><b>Audit and Security</b></h2>
61+
<h2><b>GitHub Advanced Security</b></h2>
5962
<p>
60-
Security users will probably be most interested in the Audit dashboards
63+
Open Source repositories and customers of GitHub Advanced Security have access to application security tooling such as Code Scanning, Secret Scanning, and Dependency Review.
6164
<ol>
62-
<li><a href="audit_log_activity">Audit Log Activity</a> provides a highlevel overview of what activity is going on in GitHub.</li>
63-
<li><a href="repository_audit">Repository Audit</a> lets you review changes to individual or groups of repositories </li>
64-
<li><a href="user_audit">User Change Audit</a> is the best place to review actions taken by or made to individual users.</li>
65+
<li>The <a href="security_alert_overview"> Advanced Security Overview</a> dashboard gives insight into the security posture of your GitHub Organization</li>
66+
<li>The <a href="code_scanning_overview"> Code Scanning</a> dashboard gives you access to alerts created by Code Scanning within your Organization</li>
6567
</ol>
6668
</p>
6769
</div>
@@ -85,7 +87,7 @@
8587
GitHub has several ways to collect data from their services depending on your needs. Information is available within the App on how to collect different types of data from GitHub:
8688
<ol>
8789
<li><a href="api_config">Audit Log</a> data is available through a Splunk Add-On</li>
88-
<li><a href="webhook_config">Rich commit and pull request</a> data is available through GitHub Webhooks</li>
90+
<li><a href="webhook_config">Rich commit, pull request, and Code Scanning</a> data is available through GitHub Webhooks</li>
8991
</ol>
9092
</p>
9193
</div>

‎github_app_for_splunk/default/eventtypes.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,6 @@ search = `github_webhooks` action IN ("created","edited","moved","deleted") "pr
2727

2828
[GitHub::Workflow]
2929
search = `github_webhooks` action IN ("queued","created","started","completed") workflow_job.id=*
30+
31+
[GitHub::CodeScanning]
32+
search = `github_webhooks` action IN ("appeared_in_branch", "closed_by_user", "created", "fixed", "reopened", "reopened_by_user") "alert.created_at"=*

0 commit comments

Comments
 (0)