Github Event Collector

Details

ID	`Github Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Overview

GitHub logs event collector integration for Cortex XSIAM.
This integration was integrated and tested with GitHub REST API version 2022-11-28.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure GitHub Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g. ‘https://api.github.com/orgs/XXXXX/audit-log’)		True
API Token		True
Maximum number of events per fetch		False
The event types to include	web - returns web (non-Git) events, git - returns Git events, all - returns both web and Git events.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

Permissions

To fetch audit logs, ensure the API Token includes the read:audit_log permission scope.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

github-get-events

Manual command to fetch events and display them.

Base Command

github-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g. 'https://api.github.com/orgs/XXXXX/audit-log') (required)
auth_credendtials — (required)
limit — Maximum number of events per fetch
after — First fetch timestamp
include — The event types to include
proxy — Use system proxy settings
verify — Trust any certificate (not secure)

Commands (1)

github-get-events
Manual command to fetch events and display them.

Source

GitHubEventCollector.py GitHubEventCollector_test.py GitHubEventCollector.yml GitHubEventCollector_description.md

Download History Raw

commonfields:
  id: Github Event Collector
  version: -1
sectionorder:
- Connect
- Collect
name: Github Event Collector
display: GitHub Event Collector
category: Analytics & SIEM
provider: Microsoft
description: GitHub logs event collector integration for Cortex XSIAM.
configuration:
- display: Server URL (e.g. 'https://api.github.com/orgs/XXXXX/audit-log')
  name: url
  defaultvalue: 'https://api.github.com/orgs/${ORGANIZATION}/audit-log'
  type: 0
  required: true
  section: Connect
- display: ""
  displaypassword: API Token
  name: auth_credendtials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Maximum number of events per fetch
  name: limit
  type: 0
  defaultvalue: 1000
  section: Collect
  required: false
- display: First fetch timestamp
  name: after
  type: 0
  defaultvalue: 1 minute
  section: Collect
  required: false
  hidden: true
- display: The event types to include
  additionalinfo: web - returns web (non-Git) events, git - returns Git events, all - returns both web and Git events.
  name: include
  defaultvalue: all
  type: 15
  options:
  - all
  - web
  - git
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  section: Connect
  advanced: true
  required: false
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    description: Manual command to fetch events and display them.
    name: github-get-events
  dockerimage: demisto/py3-tools:1.0.0.10120494
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
fromversion: 6.8.0
tests:
- No tests