Reference Library for Github Falco Threat Detection Rules
Sysdig Secure enables you to create and customize Threat Detection Rules to secure your environment.
This topic provides all the fields and events that apply to Falco rules for Github.
Fields
Field Class: JSON
| Name | Type | Description |
|---|
json.value | CHARBUF | Extracts a value from a JSON-encoded input. Syntax is json.value[], where is a json pointer (see https://datatracker.ietf.org/doc/html/rfc6901) |
json.obj | CHARBUF | The full json message as a text string. |
json.rawtime | CHARBUF | The time of the event, identical to evt.rawtime. |
jevt.value | CHARBUF | Alias for json.value, provided for backwards compatibility. |
jevt.obj | CHARBUF | Alias for json.obj, provided for backwards compatibility. |
jevt.rawtime | CHARBUF | Alias for json.rawtime, provided for backwards compatibility. |
Field Class: Github
| Name | Type | Description |
|---|
github.type | CHARBUF | Message type, e.g. ‘star’ or ‘repository’. |
github.action | CHARBUF | The github event action. This field typically qualifies the github.type field. For example, a message of type ‘star’ can have action ‘created’ or ‘deleted’. |
github.user | CHARBUF | Name of the user that triggered the event. |
github.repo | CHARBUF | (deprecated) URL of the git repository where the event occurred. Github Webhook payloads contain the repository property when the event occurs from activity in a repository. |
github.org | CHARBUF | Name of the organization the git repository belongs to. |
github.owner | CHARBUF | Name of the repository’s owner. |
github.repo.public | CHARBUF | ’true’ if the repository affected by the action is public. ‘false’ otherwise. |
github.collaborator.name | CHARBUF | The member name for message that add or remove users. |
github.collaborator.role | CHARBUF | The member name for message that add or remove users. |
github.webhook.id | CHARBUF | When a new webhook has been created, the webhook id. |
github.webhook.type | CHARBUF | When a new webhook has been created, the webhook type, e.g. ‘repository’. |
github.commit.modified | CHARBUF | Comma separated list of files that have been modified. |
