Elastic low stable kql

Github Activity on a Private Repository from an Unusual IP

Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

View Source

Detection Logic

data_stream.dataset:"github.audit" and event.action:("git.push" or "git.clone") and github.repository_public:false

Field Validations

Loading…

Comments (0)

Loading comments...