Update eventtypes.conf

derkkila · derkkila · commit 46721d2e2b41 · 2022-07-07T16:38:36.000-04:00
Fixed Workflow eventtype and added Workflow::Job eventtype
diff --git a/github_app_for_splunk/default/eventtypes.conf b/github_app_for_splunk/default/eventtypes.conf
@@ -50,7 +50,10 @@ search = `github_webhooks` action IN ("created", "resolved") "alert.secret_type"
 search = `github_webhooks` action IN ("create", "dismiss", "resolve") "alert.external_identifier"=*
 
 [GitHub::Workflow]
-search = `github_webhooks` action IN ("queued","created","in_progress","completed") workflow_job.id=*
+search = `github_webhooks` workflow.id=* action IN("requested","completed")
+
+[GitHub::Workflow::Job]
+search = `github_webhooks` workflow_job.id=* action IN("queued","in_progress","completed")
 
 [github:enterprise:authentication]
 search = `github_source` sourcetype=GithubEnterpriseServerAuditLog app=* authentication_service=* signature=*
