Elastic medium stable eql

GitHub Protected Branch Settings Changed

This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.

View Source

Detection Logic

configuration where data_stream.dataset == "github.audit"
  and github.category == "protected_branch" and event.type == "change"

Field Validations

Loading…

Comments (0)

Loading comments...