Elastic medium stable kql
High Number of Closed Pull Requests by User
Detects a high number of closed pull requests by a single user within a short time frame. Adversaries may close multiple pull requests to disrupt development workflows or hide malicious changes.
Detection Logic
from logs-github.audit-* metadata _id, _index, _version
| where
data_stream.dataset == "github.audit" and
github.category == "pull_request" and
event.type == "change" and
event.action == "pull_request.close"
| stats
Esql.document_count = COUNT(*),
Esql.github_org_values = values(github.org),
Esql.github_repo_values = values(github.repo),
Esql.github_user_agent_values = values(github.user_agent),
Esql.github_pull_request_url_values = values(github.pull_request_url),
Esql.user_name_values = values(user.name),
Esql.agent_id_values = values(agent.id),
Esql.data_stream_dataset_values = values(data_stream.dataset),
Esql.data_stream_namespace_values = values(data_stream.namespace)
by user.name
| keep Esql.*
| where
Esql.document_count >= 10 Field Validations
Loading…
Comments (0)
Loading comments...