Skip to content

Add sensitive exposure split query #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Aug 7, 2025
Merged

Add sensitive exposure split query #207

merged 7 commits into from
Aug 7, 2025

Conversation

knewbury01
Copy link
Contributor

@knewbury01 knewbury01 commented Jul 24, 2025 •
edited
Loading

What This PR Contributes

  • a new CAP query that uses out of the box javascript-all sources from this out of the box query . The query does not use the same sources as the js/cap-sensitive-log query (to avoid duplications) but does use the CAP specific sinks and therefore also avoids duplication of alerts with the out of the box query.

Future Works

none at this time

@knewbury01 knewbury01 requested a review from jeongsoolee09 July 24, 2025 18:10
@knewbury01 knewbury01 self-assigned this Jul 24, 2025
@jeongsoolee09
Copy link
Contributor

Can we rename the Likely/likely suffix to HeuristicSource / heuristic-source? I believe that conveys the meaning better.

jeongsoolee09
jeongsoolee09 requested changes Aug 1, 2025
View reviewed changes
Copy link
Contributor

@jeongsoolee09 jeongsoolee09 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First round of thoughts.

jeongsoolee09
jeongsoolee09 requested changes Aug 5, 2025
View reviewed changes
Copy link
Contributor

@jeongsoolee09 jeongsoolee09 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a second round of review.

@jeongsoolee09
Copy link
Contributor

Also, please add a description of the relationship of this query to the existing SensitiveExposure.

jeongsoolee09
jeongsoolee09 approved these changes Aug 7, 2025
View reviewed changes
Copy link
Contributor

@jeongsoolee09 jeongsoolee09 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@knewbury01 knewbury01 merged commit 08f7b1b into main Aug 7, 2025
5 checks passed
@knewbury01 knewbury01 deleted the knewbury01/cap-sensitive-sources branch August 7, 2025 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jeongsoolee09 jeongsoolee09 jeongsoolee09 approved these changes

Assignees

@knewbury01 knewbury01

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@knewbury01 @jeongsoolee09