Update props.conf

Added fields for workflows

Author: derkkila

github_app_for_splunk/default/props.conf

@@ -58,6 +58,7 @@ EVAL-asset_name = if(isnotnull('release.assets{}.name'), 'release.assets{}.name'
 EVAL-asset_uploader_login = if(isnotnull('release.assets{}.uploader.login'), 'release.assets{}.uploader.login', null())
 EVAL-assigned_reviewers = if(isnotnull('pull_request.requested_reviewers{}.login'), 'pull_request.requested_reviewers{}.login', null())
 EVAL-assigned_user = if(isnotnull('issue.assignee.login'), 'issue.assignee.login', 'assignee.login')
+EVAL-attempt_number = if(isnotnull('workflow_run.run_attempt'), 'workflow_run.run_attempt',null())
 EVAL-branch = if(('ref_type'=="branch" AND 'ref'!=""), 'ref', if(isnotnull('commit_branch'), 'ref', null()))
 EVAL-body = "Secrete Leakage: ".'alert.secret_type'
 EVAL-category = if(isnotnull(alert_description), "code", if(isnotnull(affected_package_name), "dependency",  if(isnotnull(secret_type), "secret", "")))
@@ -74,6 +75,7 @@ EVAL-commits_author_list = if(isnotnull('commits{}.author.username'), 'commits{}
 EVAL-commits_list = if(isnotnull('commits{}.id'), 'commits{}.id', null())
 EVAL-commits_message_list = if(isnotnull('commits{}.message'), 'commits{}.message', null())
 EVAL-commits_timestamp_list = if(isnotnull('commits{}.timestamp'), 'commits{}.timestamp', null())
+EVAL-completed = if(action="completed",_time, NULL)
 EVAL-current_priority = if('issue.labels{}.name' like "Priority%", mvfilter(match('issue.labels{}.name', "[pP]riority:\sLow|[pP]riority:\sHigh|[pP]riority:\sMedium")), null())
 EVAL-current_push = if(isnotnull('after'), 'after', null())
 EVAL-description = "Secrete Leakage: ".'alert.secret_type'
@@ -99,9 +101,11 @@ EVAL-latest_commit_author_user = if((isnotnull('commits{}.id') AND isnull('commi
 EVAL-latest_commit_date = if((isnotnull('commits{}.id') AND isnull('commit_timestamp')), 'head_commit.timestamp', if((isnotnull('commits{}.id') AND isnotnull('commit_timestamp')), 'commit_timestamp', ""))
 EVAL-latest_commit_hash = if((isnotnull('commits{}.id') AND isnull('commit_hash')), 'head_commit.id', if((isnotnull('commits{}.id') AND isnotnull('commit_hash')), 'commit_hash', if(isnotnull(after), after, null())))
 EVAL-latest_commit_message = if((isnotnull('commits{}.id') AND isnull('commit_message')), 'head_commit.message', if((isnotnull('commits{}.id') AND isnotnull('commit_message')), 'commit_message', ""))
+EVAL-name = if(isnotnull('workflow_job.name'), 'workflow_job.name',if(isnotnull('workflow_run.name'), 'workflow_run.name',null()))
 EVAL-object_attrs = "branch:" + pull_request_title + "|business:" + business
 EVAL-object_category = if(isnotnull(workflow_run.event), "workflow", if(isnotnull(repo), "repository", ""))
 EVAL-organization_name = if(isnotnull('organization.login'), 'organization.login', null())
+EVAL-pipeline_id = if(isnotnull('workflow.id'), 'workflow.id', if(isnotnull('workflow_job.id'), 'workflow_job.id', null()))
 EVAL-pr_author_login = if(isnotnull('sender.login'), 'sender.login', null())
 EVAL-pr_created_date = if(isnotnull('pull_request.created_at'), 'pull_request.created_at', null())
 EVAL-pr_id = if((isnotnull('pull_request.number')), 'pull_request.number', if((isnotnull('number')), 'number', null()))
@@ -125,8 +129,15 @@ EVAL-repository_organization = if(isnotnull('organization.login'), 'organization
 EVAL-result = "success"
 EVAL-review_author_login = if(isnotnull('review.user.login'), 'review.user.login', null())
 EVAL-review_state = if(isnotnull('review.state'), 'review.state', null())
+EVAL-run_id = if(isnotnull('workflow_job.run_id'), 'workflow_job.run_id', if(isnotnull('workflow_run.id'), 'workflow_run.id', null()))
+EVAL-run_number = if(isnotnull('workflow_run.run_number'), 'workflow_run.run_number', null())
+EVAL-severity = if(isnotnull(secret_type),"critical",severity)
 EVAL-severity_id = CASE(severity=="critical",4, severity_level=="critical",4, severity=="high",3, severity_level=="high",3, severity=="moderate",2,severity_level=="moderate", 2, isnotnull(secret_type),4, true=true, 1)
 EVAL-signature = CASE(isnull(alert_description), UPPER(severity) + " Dependency Vulnerability on package " + affected_package_name, 1=1, alert_description)
+EVAL-started = if(action="requested",_time, if(isnotnull('workflow_run.run_started_at'),round(strptime('workflow_run.run_started_at', "%Y-%m-%dT%H:%M:%SZ"),0), if(isnotnull('workflow_job.started_at'), round(strptime('workflow_job.started_at', "%Y-%m-%dT%H:%M:%SZ"),0), null())))
+EVAL-started_by_id = if(isnotnull('sender.login'), 'sender.login', null())
+EVAL-started_by_name = if(isnotnull('sender.login'), 'sender.login', null())
+EVAL-status = if(isnotnull('workflow_job.status'), 'workflow_job.status', if(isnotnull('workflow_run.status'), 'workflow_run.status', null()))
 EVAL-status_update_date = if(('action'!="" AND isnotnull('issue.updated_at')), 'issue.updated_at', null())
 EVAL-status_current = if(action=="deleted", "deleted", 'issue.state')
 EVAL-submitter_user = if(isnotnull('issue.user.login'), 'issue.user.login', null())