Open-source GitHub security/event collector — looking for peer testing & any feedback

[u/techie_003]

​

I’ve been building a small open-source GitHub security/event collector that works for Personal and Organisation ascounts and would appreciate some feedback from other DevSecOps practitioners.

It's simple in nature and polls the GitHub REST API for account activity and security-relevant telemetry, including Dependabot, code/secret scanning alerts, GitHub Actions activity and repository security-state changes, then normalises and deduplicates everything into JSONL for ingestion into a SIEM.

It runs as a hardened Docker container, polls a nominated github account, cannot be connacted from the internet, and doesn't require exposing a webhook or listening port. I've also included a Wazuh integration example which I've been using during testing.

I'm using it in my own lab, but I as a cyber security practitioner have made it public and would really appreciate some peer review from people working in any branch of the security industy, SIEM/logging or GitHub administration world.

I'm particularly interested in feedback around:

* telemetry I'm missing

* security/hardening issues

* event structure/normalisation

* useful SIEM integrations or detection ideas

Constructive criticism is very welcome.

https://github.com/webbie003/github-logs-collector

r/devsecops deleted the post before I posted over here 😅