Elastic low stable eql

GitHub Secret Scanning Disabled

Detects when GitHub Secret Scanning is disabled for a repository. Adversaries may disable secret scanning to evade detection of hardcoded secrets, such as API keys or credentials, that could be used for further compromise or data exfiltration.

View Source

Detection Logic

configuration where data_stream.dataset == "github.audit" and event.type == "change" and event.action == "repository_secret_scanning.disable"

Field Validations

Loading…

Comments (0)

Loading comments...