search

splunk / github_app_for_splunk

A collection of dashboards and knowledge objects for Github data
MIT License
32 stars 25 forks source link

Code Scanning event type is too greedy #34

Closed leftrightleft closed 2 years ago

leftrightleft commented 2 years ago

Describe the bug The code scanning event type definition is too greedy. The definition also captures secret scanning alerts. This causes difficulties when searching based on event types.

To Reproduce Steps to reproduce the behavior:

  1. Search for `eventtype="GitHub::SecretScanning"
  2. Expand the eventtype field for any result
  3. Notice that all the findings come back with both the GitHub::SecretScanning and GitHub::CodeScanning event types

Expected behavior Any event which is a secret scanning event should only return with the event type of secret scanning

Screenshots If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

Additional context Add any other context about the problem here.