Elastic medium stable eql
GitHub Repository Deleted
This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.
Detection Logic
configuration where event.module == "github" and data_stream.dataset == "github.audit" and event.action == "repo.destroy" Field Validations
Loading…
Comments (0)
Loading comments...