Skip to content

Update ThreatHuntDB with Splunk detections #9

Update ThreatHuntDB with Splunk detections

Update ThreatHuntDB with Splunk detections #9

Workflow file for this run

name: Update ThreatHuntDB with Splunk detections
on: workflow_dispatch
jobs:
update-splunk-detections:
runs-on: ubuntu-latest
steps:
- name: Checkout 🛎️
uses: actions/checkout@v4 # check out the the ThreatHuntDB repo
with:
persist-credentials: true
#ssh-key: ${{ secrets.DEPLOY_KEY }}
#- shell: bash # query Splunk public API to get latest detections
- name: Get Splunk detections with curl
run: |
curl -o ./data/splunk-detections.json https://content.splunkresearch.com/detections
- name: Add and commit changes
run: |
git config --global user.email "[email protected]"
git config --global user.name "djjoa"
git add ./data/splunk-detections.json
git commit -m "Updated ThreatHuntDB with latest Splunk detections and hunts."
git push origin main
# - uses: EndBug/add-and-commit@v9 # commit and add the new Splunk data file to the repo
# with:
# message: 'Updated Splunk detection file'
# add: './data/splunk-detections.json --force'