panther-labs / panther-analysis

Built-in Panther detection rules and policies
https://panther.com/
Apache License 2.0
339 stars 173 forks source link

Improve GitHub Webhook Modified rule #1324

Closed geoffg-sentry closed 2 months ago

geoffg-sentry commented 3 months ago

Background

The original Github.Repo.HookModified rule is inappropriately named and had some errors in its tests. The hook.* audit log events capture any webhook event that occurs in a repository, organization, GitHub Marketplace account, GitHub Sponsors account, or GitHub App. The rule initially was designed to capture any webhook modification but labelled and titled as repo-specific.

This corrects the minor error with an appropriately named rule, fixes the tests, and improves the alert title. The core logic remains the same.

Changes

Testing

pat test, make lint