GitHub GitHub Checkout, 9 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Quickly collect GitHub Enterprise Audit Logs - Splunk - GitHub Checkout

Description

The Splunk integration is available now and is delivered in two parts -

A Splunk add-on GitHub or from Splunkbase. This enables users to poll GitHub audit log via API using a Splunk Heavy Forwarder. Support for Github Audit Log Monitoring Add-On for Splunk is run through Github Issues. Open a new issue for any support issues or for feature requests. You may also open a pull request if you’d like to contribute additional dashboards, eventtypes for webhooks, or enhancements.

https://splunkbase.splunk.com/app/5595/
https://github.com/splunk/github-audit-log-monitoring-add-on-for-splunk/issues
https://github.com/splunk/github_app_for_splunk

A companion Splunk Application with helpful out of the box dashboards is also available on GitHub or from Splunkbase. The GitHub App receives inputs from the GitHub Add-on and can collect GitHub Enterprise infrastructure metrics from Collectd, and events delivered via GitHub webhooks. Support for Github App for Splunk is run through Github Issues. Please open a new issue for any support issues or for feature requests. You may also open a Pull Request if you’d like to contribute additional dashboards, eventtypes for webhooks, or enhancements you may have.

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Sup y'all, this is b-duggy and I've got a feature for you to check out.

A

So if you've been keeping tabs here on the changelog post as well as on our blog, you know that we've been shipping a lot of stuff, and today we have a special guest, doug erickala from splunk and he's going to be talking about two things: the github app for splunk, as well as the github add-on for splunk to embed that inside of your splunk dashboard. So without further ado doug. Why don't you take it away?.

B

Well, thank you so much and if you're not familiar with splunk we're a data platform, it doesn't matter what kind of data it is often we use it for it or security use cases, but it can be any data whether it be change, data temperature fluctuations, etc.

B

We collect data and give you the power to do what you want with it and in this case we're giving you the power to access your github api audit logs and use those and retain them as long as you want and start to correlate that data across multiple different types of events. So at the high level we bring all that data in allow you to visualize it and provide dashboards, and if you want take action with that, so we'll actually start with diving into. How do you get it?

B

And how do you connect it up so to download it? You would go to splunk base, which is kind of the splunk app store where you go to collect all of your different interconnection pieces or dashboards. So you would search for the github audit log monitoring add-on for splunk. This is the technical piece. That's going to do all the data collection and then we have the github app for splunk. This is the visual layer.

B

That'll, give you all the pretty dashboards that let you do something with the data so once you've got it installed on your splunk environment you'll be able to go into your data inputs, which is located under settings data inputs and there will be an option for github enterprise audit log monitoring.

B

Once you click on that, I already have an input here, but you'll go to create a new input and I'll just be able to show you the example, one that we have here you by default you'll use the api hostname that you have there. You provided your github enterprise cloud enterprise name here, so you can copy and paste that over you will need to create a personal access token in that enterprise. More details are all in the documentation.

B

I'll show you in a moment and then you'll click you'll use the default of all event types, and you can tweak how many uh entries per run you do or how frequent you run this. So you can go under here. There's the interval for how frequently you want it by default, we we actually collect data every minute.

B

There are some tips and tricks in the documentation for how to to tweak that if you need to and then you assign the index for it there, but since we've already got data flowing in I'll, give you a glance at it. This is just the raw data coming in from that add-on and at first, it's kind of hard to understand, what's going on here, because it's just generic data, but where the real power for this comes in is once you pair this with the github app for splunk. So we have out of the box.

B

We have three audit related dashboards that are at your disposal. There's the audit log activity, which is a really high level overview of what's going on within your enviro within your enterprise environment, you can see what the top event types are. What the top active users are, you're, also able to see where people are taking active or where people are active from around the globe. So we have the option to view it as a map or if you would just prefer a number lay a number layout.

B

You can actually see the list of the countries and how many events have come per country. That's the high level view of what's going on with your audit logs, but if you want to start getting into individual repositories and who's doing what within those, we also have a repository audit log dashboard that lets you look across all of your all of your repositories and allow you to drill down to specific ones.

B

So, for example, I've got this one. That's called epic repo and I can select that and I can see who's taken what activity in that repository, what different actions have taken place? So we can see here, we've turned on the github actions. We've removed a member we've also completed some workflow runs.

B

We see a just a time, a time based list of all the different changes that have happened. We can also see the time based list of user changes to that repository like who's been granted access, who's been removed access, and then we can see all of the github actions that have been run within that repo and whenever we click one of these, it will actually take us to github, where you can review that github action execution and then to finish out the audit log portion. There's the user change dashboard.

B

This lets you really dive into what's been going on with individual users, so if you suspect some security incident or you're trying to figure out why a person may not have the access that they used to have, you can go through and you can see all of the user changes that have happened or if you really want to look for what user a specific user.

B

So in this case, let's look for link and we'll look at all actions that have that have taken been taken on link's user account, so we can see that we've restored the member uh in march, we've also added the member a few times. We've invited them and we've added them as an admin, and that's just if I want to look up a the history of a single user. I can also do that and see. Okay. Not only do I want to see what actions have been taken generally, but I can also say by whom.

B

So, if I want to see okay, let's see all the actions taken by my account and boom. I can see that I've done a lot. I've done a few actions over time. I've removed an outside collaborator.

B

I've invited some members, and it shows me based on time- and this is this- is the first release of this of this app. We've started out very heavily focused on audit information, but we are expanding that capability out to github enterprise, server monitoring as well, so with just some uh some additional configuration.

B

You can also start to look at other elements within um within github enterprise server. If you're using that on premises, you can actually start to get things like cpu utilization memory, load of your environment processes and whatnot. All of this is continually being expanded and we do have a github repository available for this, both for the the technical add-on that does all the actual collecting of data, as well as the github app for splunk has a github repository for it as well.

B

So you can pull issue, you can create an issue if you have requests, there's also a project for feature requests here too, and all the documentation for what the app does, how to connect it to things like the github apis and the enterprise server monitoring as well excellent.

A

So folks, if you want to get your hands on, this, definitely keep an eye on blogs.splunk.com and if you want to see more features on github, stick around and watch the next.

A