Elastic medium stable eql
New GitHub Owner Added
Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
Detection Logic
iam where data_stream.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin"Field Validations
Loading…
Comments (0)
Loading comments...