Detection rules › Kusto
GitHub Security Vulnerability in Repository
'This alerts when there is a new security vulnerability in a GitHub repository.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Execution | |
| Privilege Escalation | |
| Stealth | |
| Credential Access | |
| Lateral Movement |
Rule body
id: 5436f471-b03d-41cb-b333-65891f887c43
name: GitHub Security Vulnerability in Repository
description: |
'This alerts when there is a new security vulnerability in a GitHub repository.'
severity: Informational
requiredDataConnectors: []
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- Execution
- PrivilegeEscalation
- DefenseEvasion
- CredentialAccess
- LateralMovement
relevantTechniques:
- T1190
- T1203
- T1068
- T1211
- T1212
- T1210
query: |
GitHubRepo
| where Action == "vulnerabilityAlert"
| project TimeGenerated, DismmisedAt, Reason, vulnerableManifestFilename, Description, Link, PublishedAt, Severity, Summary
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: Link
version: 1.0.3
kind: Scheduled
Stages and Predicates
Stage 1: source
GitHubRepo
Stage 2: where
| where Action == "vulnerabilityAlert"
Stage 3: project
| project TimeGenerated, DismmisedAt, Reason, vulnerableManifestFilename, Description, Link, PublishedAt, Severity, Summary
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Action | eq |
| field:"Action" kind:eq value:"vulnerabilityAlert" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
Description | project |
DismmisedAt | project |
Link | project |
PublishedAt | project |
Reason | project |
Severity | project |
Summary | project |
TimeGenerated | project |
vulnerableManifestFilename | project |