pentestfail / ta-github Goto Github PK

Hi Evan,

Just downloaded your add-on and it works great. Would be nice though if you add an ability to provide additional parameters in the inputs configurations. In my case, I need to pull only closed issues into the splunk however github's default api pulls open issues only.

To work around, I had to change input_module_github_api_repos_issues and to add parameter['state'] = "closed", see below

    # Create API request parameters    
    auth = base64.b64encode(git_username + ":" + git_password).decode("ascii")
    header =  {'Authorization': 'Basic {}'.format(auth)}
    parameter = {}
    parameter['since'] = last_status
    parameter['per_page'] = git_pagesize
    parameter['state'] = "closed"
    method = 'GET'

How do I configure the api to access a local github repo. that is accessible as a https URL?

Specifically where do I put the TLS cert?

And should I configure the switch to use the v3 api?

TA-Github/default/props.conf:TIMESTAMP_FIELDS = committers.date

It should be TA-Github/default/props.conf:TIMESTAMP_FIELDS = committer.date

Please could you tell me why we are seeing this error?

2019-01-16 14:24:24,007 ERROR pid=20699 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-Github/bin/ta_github/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-Github/bin/github_api_repos_commits.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-Github/bin/input_module_github_api_repos_commits.py", line 135, in collect_events raise error HTTPError: 409 Client Error: Conflict for url: https://git.xxx.xxx/api/v3/repos/Foo/repo/commits?since=2018-01-25&per_page=50

2019-01-16 14:24:15,844 ERROR pid=19785 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-Github/bin/ta_github/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-Github/bin/github_api_repos_commits.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-Github/bin/input_module_github_api_repos_commits.py", line 135, in collect_events raise error HTTPError: 409 Client Error: Conflict for url: https://git.xxx.xxx/api/v3/repos/BAR/prj/commits?per_page=50&since=2018-01-25

Retrieval of commits is failing with error
GlobalConfigError: Config Not Found for Input
Log file
base_modinput.py

Initial Configuration page hangs during initial setup

Steps to reproduce - Install App:Github Addon on Splunk Enterprise 7