detection.wiki

GitHub coverage

153 GitHub detection rules across 6 vendors covering 171 (category, action) pairs.

Attributed to a specific audit action

114 rules that name a specific GitHub audit action, mapped to that action's catalog event.

audit_log_streaming 5 rules (2 actions)

audit_log_streaming.destroy 2 rules
audit_log_streaming.update 3 rules

auto_approve_personal_access_token_requests 2 rules (2 actions)

auto_approve_personal_access_token_requests.disable 1 rule
auto_approve_personal_access_token_requests.enable 1 rule

business 19 rules (14 actions)

business.delete 1 rule
business.disable_oidc 2 rules
business.disable_saml 2 rules
business.disable_two_factor_requirement 3 rules
business.invite_admin 1 rule
business.invite_billing_manager 1 rule
business.members_can_update_protected_branches.disable 1 rule
business.recovery_codes_downloaded 1 rule
business.recovery_codes_generated 1 rule
business.recovery_codes_printed 1 rule
business.recovery_codes_viewed 1 rule
business.referrer_override_disable 1 rule
business.remove_organization 2 rules
business.update_saml_provider_settings 1 rule

business_advanced_security 6 rules (4 actions)

business_advanced_security.disabled 2 rules
business_advanced_security.disabled_for_new_repos 2 rules
business_advanced_security.disabled_for_new_user_namespace_repos 1 rule
business_advanced_security.user_namespace_repos_disabled 1 rule

business_dependabot_alerts 1 rule (1 action)

business_dependabot_alerts.disable 1 rule

business_dependabot_alerts_new_repos 1 rule (1 action)

business_dependabot_alerts_new_repos.disable 1 rule

business_secret_scanning 6 rules (2 actions)

business_secret_scanning.disable 3 rules
business_secret_scanning.disabled_for_new_repos 3 rules

business_secret_scanning_custom_pattern_push_protection 3 rules (1 action)

business_secret_scanning_custom_pattern_push_protection.disabled 3 rules

business_secret_scanning_push_protection 6 rules (2 actions)

business_secret_scanning_push_protection.disable 3 rules
business_secret_scanning_push_protection.disabled_for_new_repos 3 rules

business_secret_scanning_push_protection_custom_message 2 rules (1 action)

business_secret_scanning_push_protection_custom_message.disable 2 rules

codespaces 2 rules (2 actions)

codespaces.create_an_org_secret 1 rule
codespaces.destroy 1 rule

dependabot_alerts 3 rules (1 action)

dependabot_alerts.disable 3 rules

dependabot_alerts_new_repos 3 rules (1 action)

dependabot_alerts_new_repos.disable 3 rules

dependabot_security_updates 3 rules (1 action)

dependabot_security_updates.disable 3 rules

dependabot_security_updates_new_repos 3 rules (1 action)

dependabot_security_updates_new_repos.disable 3 rules

enterprise 2 rules (1 action)

enterprise.register_self_hosted_runner 2 rules

environment 2 rules (2 actions)

environment.create_actions_secret 1 rule
environment.delete 1 rule

forbid_auto_approve_personal_access_token_requests 2 rules (2 actions)

forbid_auto_approve_personal_access_token_requests.disable 1 rule
forbid_auto_approve_personal_access_token_requests.enable 1 rule

git 10 rules (3 actions)

git.clone 6 rules
git.fetch 1 rule
git.push 3 rules

integration_installation 3 rules (1 action)

integration_installation.create 3 rules

ip_allow_list 5 rules (4 actions)

ip_allow_list.disable 2 rules
ip_allow_list.disable_for_installed_apps 1 rule
ip_allow_list.enable 1 rule
ip_allow_list.enable_for_installed_apps 1 rule

ip_allow_list_entry 3 rules (3 actions)

ip_allow_list_entry.create 1 rule
ip_allow_list_entry.destroy 1 rule
ip_allow_list_entry.update 1 rule

migration 1 rule (1 action)

migration.create 1 rule

oauth_application 1 rule (1 action)

oauth_application.remove_client_secret 1 rule

org 60 rules (37 actions)

org.add_member 5 rules
org.advanced_security_disabled_for_new_repos 2 rules
org.advanced_security_disabled_on_all_repos 2 rules
org.advanced_security_policy_selected_member_disabled 2 rules
org.block_user 3 rules
org.create_actions_secret 1 rule
org.disable_oauth_app_restrictions 3 rules
org.disable_saml 1 rule
org.disable_two_factor_requirement 7 rules
org.enable_oauth_app_restrictions 1 rule
org.enable_two_factor_requirement 1 rule
org.invite_member 3 rules
org.recovery_codes_downloaded 1 rule
org.recovery_codes_generated 1 rule
org.recovery_codes_printed 1 rule
org.recovery_codes_viewed 1 rule
org.register_self_hosted_runner 1 rule
org.remove_member 2 rules
org.remove_outside_collaborator 1 rule
org.remove_self_hosted_runner 1 rule
org.runner_group_created 1 rule
org.runner_group_removed 1 rule
org.runner_group_runner_removed 1 rule
org.runner_group_runners_added 1 rule
org.runner_group_runners_updated 1 rule
org.runner_group_updated 1 rule
org.saml_disabled 1 rule
org.saml_enabled 1 rule
org.secret_scanning_custom_pattern_push_protection_disabled 1 rule
org.secret_scanning_push_protection_disable 1 rule
org.secret_scanning_push_protection_new_repos_disable 1 rule
org.set_default_workflow_permissions 1 rule
org.transfer 1 rule
org.transfer_outgoing 2 rules
org.unblock_user 1 rule
org.update_member 2 rules
org.update_saml_provider_settings 2 rules

org_credential_authorization 3 rules (3 actions)

org_credential_authorization.deauthorize 1 rule
org_credential_authorization.grant 1 rule
org_credential_authorization.revoke 1 rule

org_secret_scanning_generic_secrets 1 rule (1 action)

org_secret_scanning_generic_secrets.disabled 1 rule

organization_moderators 1 rule (1 action)

organization_moderators.add_user 1 rule

payment_method 1 rule (1 action)

payment_method.remove 1 rule

personal_access_token 4 rules (3 actions)

personal_access_token.access_granted 2 rules
personal_access_token.access_revoked 1 rule
personal_access_token.request_created 1 rule

private_repository_forking 2 rules (2 actions)

private_repository_forking.clear 1 rule
private_repository_forking.enable 1 rule

project 2 rules (2 actions)

project.delete 1 rule
project.update_user_permission 1 rule

protected_branch 7 rules (3 actions)

protected_branch.destroy 3 rules
protected_branch.policy_override 2 rules
protected_branch.rejected_ref_update 2 rules

public_key 3 rules (2 actions)

public_key.create 2 rules
public_key.update 1 rule

pull_request 3 rules (3 actions)

pull_request.close 1 rule
pull_request.create 1 rule
pull_request.merge 1 rule

repo 38 rules (17 actions)

repo.access 4 rules
repo.add_member 1 rule
repo.advanced_security_disabled 2 rules
repo.advanced_security_policy_selected_member_disabled 1 rule
repo.archived 5 rules
repo.create 5 rules
repo.create_actions_secret 1 rule
repo.destroy 6 rules
repo.download_zip 2 rules
repo.pages_public 1 rule
repo.register_self_hosted_runner 2 rules
repo.remove_member 1 rule
repo.remove_self_hosted_runner 1 rule
repo.transfer 1 rule
repo.transfer_outgoing 3 rules
repo.transfer_start 1 rule
repo.unarchived 1 rule

repository_branch_protection_evaluation 1 rule (1 action)

repository_branch_protection_evaluation.disable 1 rule

repository_ruleset 2 rules (1 action)

repository_ruleset.destroy 2 rules

repository_secret_scanning 3 rules (1 action)

repository_secret_scanning.disable 3 rules

repository_secret_scanning_custom_pattern_push_protection 1 rule (1 action)

repository_secret_scanning_custom_pattern_push_protection.disabled 1 rule

repository_secret_scanning_generic_secrets 1 rule (1 action)

repository_secret_scanning_generic_secrets.disabled 1 rule

repository_secret_scanning_push_protection 2 rules (1 action)

repository_secret_scanning_push_protection.disable 2 rules

repository_vulnerability_alert 1 rule (1 action)

repository_vulnerability_alert.dismiss 1 rule

repository_vulnerability_alerts 5 rules (1 action)

repository_vulnerability_alerts.disable 5 rules

secret_scanning 3 rules (1 action)

secret_scanning.disable 3 rules

secret_scanning_alert 2 rules (1 action)

secret_scanning_alert.create 2 rules

secret_scanning_new_repos 3 rules (1 action)

secret_scanning_new_repos.disable 3 rules

secret_scanning_push_protection 1 rule (1 action)

secret_scanning_push_protection.bypass 1 rule

ssh_certificate_authority 1 rule (1 action)

ssh_certificate_authority.create 1 rule

ssh_certificate_requirement 1 rule (1 action)

ssh_certificate_requirement.disable 1 rule

sso_redirect 1 rule (1 action)

sso_redirect.disable 1 rule

team 8 rules (7 actions)

team.add_member 1 rule
team.add_repository 2 rules
team.change_parent_team 1 rule
team.create 1 rule
team.destroy 1 rule
team.remove_member 1 rule
team.remove_repository 1 rule

workflows 2 rules (2 actions)

workflows.completed_workflow_run 1 rule
workflows.created_workflow_run 1 rule

Not attributed to a GitHub audit action

40 rules that resolve to no GitHub audit action.

(unattributed) 53 rules (18 actions)

assigned 1 rule
bypass 1 rule
closed 1 rule
completed 4 rules
converted_to_draft 1 rule
created 2 rules
edited 3 rules
labeled 1 rule
opened 2 rules
ready_for_review 1 rule
reopened 1 rule
requested 1 rule
submitted 1 rule
synchronize 1 rule
unassigned 1 rule
unlabeled 1 rule
vulnerabilityAlert 1 rule
(any) 29 rules