Github Event Collector

Details

ID	`Github Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Overview

GitHub logs event collector integration for Cortex XSIAM.
This integration was integrated and tested with GitHub REST API version 2022-11-28.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure GitHub Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g. ‘https://api.github.com/orgs/XXXXX/audit-log’)		True
API Token		True
Maximum number of events per fetch		False
The event types to include	web - returns web (non-Git) events, git - returns Git events, all - returns both web and Git events.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

Permissions

To fetch audit logs, ensure the API Token includes the read:audit_log permission scope.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

github-get-events

Manual command to fetch events and display them.

Base Command

github-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g. 'https://api.github.com/orgs/XXXXX/audit-log') (required)
auth_credendtials — (required)
limit — Maximum number of events per fetch
after — First fetch timestamp
include — The event types to include
proxy — Use system proxy settings
verify — Trust any certificate (not secure)

Commands (1)

github-get-events
Manual command to fetch events and display them.

Source

GitHubEventCollector.py GitHubEventCollector_test.py GitHubEventCollector.yml GitHubEventCollector_description.md

Download History Raw

import datetime

import pytest
from freezegun import freeze_time
from GitHubEventCollector import GithubGetEvents, demisto, get_github_timestamp_format


def test_last_run(mocker):
    """
    Given:
        - A list of events
    When:
        - Getting the last run
    Then:
        - Ensure the last run is the last event in isoformat
        - Ensure the last run is not changed when no events are returned

    Note: This test could fail locally because of timezone differences. Run it on a docker image.
    """

    # get some events
    events = [{"@timestamp": 1619510200000}, {"@timestamp": 1619510300000}, {"@timestamp": 1619510400000}]
    last_run = GithubGetEvents.get_last_run(events)

    # make sure the last run is the last event in isoformat
    assert last_run == {"after": 1619510400000}

    # now get no events, and make sure the last run is not changed
    mocker.patch.object(demisto, "getLastRun", return_value=last_run)
    assert GithubGetEvents.get_last_run([]) == last_run


@freeze_time("2021-11-15T00:00:00Z")
def test_get_github_timestamp_format():
    """
    Given:
        - A time in few variations
    When:
        - Running thq get_github_timestamp_format function
    Then:
        - Ensure the output is in the form 'created:><year>-<month>-<day>T<hours>:<minutes>:<seconds>Z'

    Note: This test could fail locally because of timezone differences. Run it on a docker image.
    """

    # Test conversion of an int value (representing an epoch timestamp)
    timestamp = 1636934400000
    result = get_github_timestamp_format(timestamp)
    expected_result = "created:>2021-11-15T00:00:00Z"
    assert result == expected_result

    # Test conversion of a str value (representing a date string)
    date_string = "3 days ago"
    result = get_github_timestamp_format(date_string)
    expected_result = "created:>2021-11-12T00:00:00Z"
    assert result == expected_result

    # Test conversion of a datetime object
    datetime_object = datetime.datetime(2021, 11, 15, 12, 0, 0)
    result = get_github_timestamp_format(datetime_object)
    expected_result = "created:>2021-11-15T12:00:00Z"
    assert result == expected_result

    # Test that a TypeError is raised for an unsupported input type
    unsupported_type = "foo"
    with pytest.raises(TypeError) as e:
        get_github_timestamp_format(unsupported_type)
    assert "after is not a valid time" in e.value.args[0]