Add "Inactive Account Have Activity Detected" #1020
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: appinspect | |
| on: | |
| pull_request_target: | |
| types: [opened, reopened, synchronize] | |
| jobs: | |
| appinspect: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repository code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: refs/pull/${{ github.event.pull_request.number }}/merge | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| architecture: 'x64' | |
| - name: Install Python Dependencies and ContentCTL and Atomic Red Team | |
| run: | | |
| pip install contentctl>=4.0.0 | |
| git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team | |
| git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti | |
| - name: Running appinspect with enrichments | |
| env: | |
| APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}" | |
| APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" | |
| run: | | |
| echo $APPINSPECTUSERNAME | |
| contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments --enable-metadata-validation --suppress-missing-content-exceptions | |
| echo "done appinspect" | |
| mkdir -p artifacts/app_inspect_report | |
| cp -r dist/*.html artifacts/app_inspect_report | |
| cp -r dist/*.tar.gz artifacts/ | |
| - name: store_artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: content-latest | |
| path: | | |
| artifacts/DA-ESS-ContentUpdate-latest.tar.gz | |
| artifacts/app_inspect_report |