Elastic low stable eql

GitHub App Deleted

Detects the deletion of a GitHub app either from a repo or an organization.

View Source

Detection Logic

configuration where data_stream.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"

Field Validations

Loading…

Comments (0)

Loading comments...