Github Event Collector

Details

ID	`Github Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Overview

GitHub logs event collector integration for Cortex XSIAM.
This integration was integrated and tested with GitHub REST API version 2022-11-28.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure GitHub Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g. ‘https://api.github.com/orgs/XXXXX/audit-log’)		True
API Token		True
Maximum number of events per fetch		False
The event types to include	web - returns web (non-Git) events, git - returns Git events, all - returns both web and Git events.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

Permissions

To fetch audit logs, ensure the API Token includes the read:audit_log permission scope.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

github-get-events

Manual command to fetch events and display them.

Base Command

github-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g. 'https://api.github.com/orgs/XXXXX/audit-log') (required)
auth_credendtials — (required)
limit — Maximum number of events per fetch
after — First fetch timestamp
include — The event types to include
proxy — Use system proxy settings
verify — Trust any certificate (not secure)

Commands (1)

github-get-events
Manual command to fetch events and display them.

Source

GitHubEventCollector.py GitHubEventCollector_test.py GitHubEventCollector.yml GitHubEventCollector_description.md

Download History Raw

# GitHub Event Collector

Integration with GitHub using REST API to get audit logs for an organization.

## Server URL

Specify the endpoint for fetching audit logs; replace the `${ORGANIZATION}` value with your organization: `https://api.github.com/orgs/${ORGANIZATION}/audit-log`

## API Token

1. [Verify your email address](https://docs.github.com/en/enterprise-cloud@latest/account-and-profile/how-tos/email-preferences/verifying-your-email-address), if it has not been verified yet.
2. In GitHub, click your profile picture, then click **Settings**.
3. In the left sidebar, click **Developer settings**.
4. In the left sidebar, under **Personal access tokens**, click **Tokens (classic)**.
5. Select **Generate new token**, then click **Generate new token (classic)**.
6. In the **Note** field, give the token a descriptive name.
7. Select a suitable **Expiration** date by choosing the default option or click **Custom** to enter a specific date.
8. Select the **Scopes** to grant this token. To fetch audit logs, ensure the token includes the `read:audit_log` permission scope.
9. Click **Generate token**.
10. Save the token in a secure location and use it to configure an instance of this integration.
11. Test the configuration and save the instance.

For more information, refer to the documentation on [creating a GitHub personal access token (classic)](https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) and [accessing the GitHub audit logs of an organization](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise).

## Permissions

To fetch audit logs, ensure the API Token includes the `read:audit_log` permission scope.