Panther informational experimental python

GitHub User Access Key Created

Detects when a GitHub user access key is created.

View Source

Detection Logic

def rule(event):

    return event.get("action") == "public_key.create"


def title(event):
    return f"User [{event.udm('actor_user')}] created a new ssh key"

Field Validations

Loading…

Comments (0)

Loading comments...