GitHub Dependabot Vulnerability Dismissed

AnalysisType: rule
DisplayName: "GitHub Dependabot Vulnerability Dismissed" 
Enabled: true
Filename: github_repo_vulnerability_dismissed.py
RuleID: "Github.Repo.VulnerabilityDismissed"
Severity: High
Threshold: 1
Description: >
  Creates an alert if a dependabot alert is dismissed without being fixed.
LogTypes:
  - GitHub.Audit
Tests:
  - Name: Not GitHub Dependabot Vulnerability Dismissed
    LogType: GitHub.Audit
    ExpectedResult: false
    Log: 
      { 
        "action": "not_repository_vulnerability_alert.dismiss", 
      }
  - Name: GitHub Dependabot Vulnerability Dismissed
    LogType: GitHub.Audit
    ExpectedResult: true
    Log:
      {
      "_document_id": "Z7JUOWzi2wKeWsZcOhbS9w",
      "action": "repository_vulnerability_alert.dismiss",
      "active": true,
      "actor": "badger",
      "actor_id": "1234567",
      "actor_is_bot": false,
      "alert_number": 8,
      "at_sign_timestamp": "2024-04-09 06:17:55.186000000",
      "business": "acme",
      "business_id": "11244",
      "created_at": "2024-03-13 22:36:27.788000000",
      "external_identity_nameid": "badger@acme.com",
      "ghsa_id": "GHSA-1234-5678-9090",
      "operation_type": "modify",
      "org": "acme",
      "org_id": 42053323,
      "public_repo": true,
      "repo": "acme/repo",
      "repo_id": 6532371245,
      "user": "badger",
      "user_agent": "Mozilla/5.0 (Macintosh Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",
      "user_id": "1270063"
    }


# ------ paired body: github_repo_vulnerability_dismissed.py ------

from panther_github_helpers import github_alert_context


def rule(event):
    if event.get("action") == "repository_vulnerability_alert.dismiss":
        return True
    return False


def title(event):
    return f"GitHub Dependabot Vulnerability Dismissed by {event.get('actor')}: {event.get('repo')}"


def alert_context(event):
    context = github_alert_context(event)
    alert_url = (
        f"https://github.com/{event.get('repo')}/security/dependabot/{event.get('alert_number')}"
    )
    return context | {"alert_url": alert_url}