Panther high experimental python

GitHub Branch Protection Policy Override

Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.

View Source

Detection Logic

def rule(event):

    return event.get("action") == "protected_branch.policy_override"


def title(event):
    branch = event.get("branch", "<UNKNOWN_BRANCH>")
    return (
        f"A branch protection requirement in the repository"
        f" [{event.get('repo', '<UNKNOWN_REPO>')}]"
        f" was overridden by user [{event.udm('actor_user')}]"
        f" on branch [{branch}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...