tailpipe-mod-github-security-log-detections/locals.pp at main · turbot/tailpipe-mod-github-security-log-detections · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
// Benchmarks and controls for specific services should override the "service" tag
locals {
  github_security_log_detections_common_tags = {
    category = "Detections"
    plugin   = "github"
    service  = "GitHub/Account"
  }
}

locals {
  # Local internal variables to build the SQL select clause for common
  # dimensions. Do not edit directly.

  detection_sql_columns = <<-EOQ
  tp_timestamp as timestamp,
  action as operation,
  __RESOURCE_SQL__ as resource,
  actor,
  tp_source_ip as source_ip,
  tp_id as source_id,
  *
  exclude (actor, timestamp)
  EOQ


  detection_display_columns_user = [
    "timestamp",
    "operation",
    "resource",
    "actor",
    "source_ip",
    "source_id"
  ]
}

locals {
  # Local internal variables to build the SQL select clause for common
  # dimensions. Do not edit directly.
  detection_sql_resource_column_personal_access_token_name = replace(local.detection_sql_columns, "__RESOURCE_SQL__", "user_programmatic_access_name")
  detection_sql_resource_column_user_name = replace(local.detection_sql_columns, "__RESOURCE_SQL__", "concat('https://github.com/', user)")
  detection_sql_resource_column_ssh_key = replace(local.detection_sql_columns, "__RESOURCE_SQL__", "fingerprint")
  detection_sql_resource_column_email = replace(local.detection_sql_columns, "__RESOURCE_SQL__", "email")
}