Elastic medium stable eql

GitHub Repository Deleted

This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.

View Source

Detection Logic

configuration where event.module == "github" and data_stream.dataset == "github.audit" and event.action == "repo.destroy"

Field Validations

Loading…

Comments (0)

Loading comments...