Send GitHub events to Cortex XCOR

To send GitHub events to Palo Alto Networks Cortex XCOR, create a webhook within GitHub and include a secret token to authenticate with Cortex XCOR. For more information, refer to webhook events and payloads in the GitHub documentation.

Obtain an API token

Before sending events from GitHub, contact Cortex XCOR Support to obtain an API token to authenticate with Cortex XCOR.

This API token differs from an API token that’s generated when you create a service account.

Create a GitHub webhook

To send GitHub events to Cortex XCOR:

In GitHub, open the repository you want to configure a webhook for.
Click Settings.
Under Code and automation, click Webhooks.

In the Add webhook window, in the Payload URL field, enter:

https://TENANT.chronosphere.io/api/v1/data/events/receiver/github

Select application/json as the Content type.
In the Secret field, enter the API token you obtained from Cortex XCOR Support.
Choose Let me select individual events, and then select Deployment and Deployment Status as the events to trigger the webhook.
Save your webhook.

Map GitHub events to Cortex XCOR events

After creating a GitHub webhook to send events to Cortex XCOR, Cortex XCOR automatically maps the GitHub payload to change events. You can’t customize how the payload maps to change events. If you want to modify how the GitHub payload gets mapped, contact Cortex XCOR Support. The following table indicates the fields and values that Cortex XCOR produces from a GitHub webhook event:

Field	Value
`category`	`deploys`
`type`	`deploy_ACTION`
`source`	`github`
`happened_at`	`TIMESTAMP`
`title`	`TITLE`

Replace the following:

ACTION: For deployment events, the type is always deploy_start. For deployment_status events, the type is deploy_ followed by the GitHub deployment status state, such as deploy_in_progress, deploy_success, or deploy_failure.
TIMESTAMP: The time the event occurred, taken from the deployment’s created_at field. Must be within seven days of the current time.
TITLE: A description generated from the repository name and environment, such as “Deployment for my-repo in environment production started”.

Cortex XCOR maps the following labels by default:

Label	Source	Event types
`environment`	Deployment environment	`deployment`, `deployment_status`
`deployment.sha`	Deployment commit SHA	`deployment`, `deployment_status`
`deployment.log_url`	Deployment status log URL	`deployment_status` only

This snippet illustrates how to set a shell variable PAYLOAD to a JSON string that mimics a GitHub deployment webhook payload. The resulting $SIGNATURE is used in the X-Hub-Signature: sha1=$SIGNATURE header of the following curl request. The receiver validates authenticity by recomputing this same Hash-based Message Authentication Code (HMAC) against the stored secret token and comparing it to the header value, which is the same mechanism GitHub uses when delivering real webhooks.

# Generate the HMAC-SHA1 signature for the payload
PAYLOAD='{"deployment":{"created_at":"2024-07-24T14:15:22Z","environment":"staging","sha":"abc123def456","url":"https://api.github.com/repos/my-org/my-repo/deployments/1"},"repository":{"name":"my-repo"}}'
SIGNATURE=$(echo -n "$PAYLOAD" | openssl dgst -sha1 -hmac "$SECRET_TOKEN" | awk '{print $2}')

The following sample request simulates a GitHub deployment webhook. Replace the following:

TENANT: Your organization name from your Cortex XCOR tenant.
SECRET_TOKEN: The secret token configured in your GitHub webhook and registered with Cortex XCOR.

curl --request POST \
  --url https://TENANT.chronosphere.io/api/v1/data/events/receiver/github \
  --header "Content-Type: application/json" \
  --header "X-Github-Event: deployment" \
  --header "X-Hub-Signature: sha1=$SIGNATURE" \
  --data "$PAYLOAD"

This request produces a change event with the following values:

Field	Value
`category`	`deploys`
`type`	`deploy_start`
`source`	`github`
`title`	`Deployment for my-repo in environment staging started`
`environment`	`staging`
`deployment.sha`	`abc123def456`

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Obtain an API token

Create a GitHub webhook

Map GitHub events to Cortex XCOR events

​Obtain an API token

​Create a GitHub webhook

​Map GitHub events to Cortex XCOR events

Obtain an API token

Create a GitHub webhook

Map GitHub events to Cortex XCOR events