Elastic medium stable eql

GitHub Owner Role Granted To User

This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

View Source

Detection Logic

iam where data_stream.dataset == "github.audit" and event.action == "org.update_member" and github.permission == "admin"

Field Validations

Loading…

Comments (0)

Loading comments...