Browse Rules

GitHub Repo Created

A new GitHub repository was created.

GitHub PAT Access Revoked

Access to private GitHub organization resources was revoked for a PAT.

GitHub User Blocked From Organization

A GitHub user was blocked from access to an organization.

New User Added To GitHub Organization

A new user was added to a GitHub organization.

Member Removed From GitHub Organization

A member was removed or their invitation to join was removed from a GitHub Organization.

GitHub UEBA - Multiple Alerts from a GitHub Account

This rule is part of the "GitHub UEBA - Unusual Activity from Account Pack", and leverages alert data to determine when multiple alerts are executed by the same user in a timespan of one hour. Analysts can use this to prioritize triage and response, as these alerts are a higher indicator of compromised user accounts or PATs.

First Occurrence of Personal Access Token (PAT) Use For a GitHub User

A new PAT was used for a GitHub user not previously seen in the last 14 days.

First Occurrence of IP Address For GitHub User

Detects a new IP address used for a GitHub user not previously seen in the last 14 days.

First Occurrence of User-Agent For a GitHub User

Detects a new user agent used for a GitHub user not previously seen in the last 14 days.

First Occurrence of GitHub User Interaction with Private Repo

Detects a new private repo interaction for a GitHub user not seen in the last 14 days.

First Occurrence of IP Address For GitHub Personal Access Token (PAT)

Detects a new IP address used for a GitHub PAT not previously seen in the last 14 days.

First Occurrence of User Agent For a GitHub Personal Access Token (PAT)

Detects a new user agent used for a GitHub PAT not previously seen in the last 14 days.

First Occurrence GitHub Event for a Personal Access Token (PAT)

Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.

First Occurrence of GitHub Repo Interaction From a New IP

Detects an interaction with a private GitHub repository from a new IP address not seen in the last 14 days.

First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)

Detects a new private repo interaction for a GitHub PAT not seen in the last 14 days.

High Number of Cloned GitHub Repos From PAT

Detects a high number of unique private repo clone events originating from a single personal access token within a short time period.

New GitHub Owner Added

Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

GitHub Owner Role Granted To User

This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

GitHub Repository Deleted

This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.