Elastic low stable eql

GitHub Private Repository Turned Public

Detects when a private GitHub repository is changed to public visibility. Adversaries may change repository visibility to public in order to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

View Source

Detection Logic

configuration where data_stream.dataset == "github.audit" and github.operation_type == "modify" and github.category == "repo" and
event.action == "repo.access" and github.visibility == "public"

Field Validations

Loading…

Comments (0)

Loading comments...