Auto Approve Personal Access Token Requests
| action | Description | Sample | Rule |
|---|---|---|---|
| auto_ | Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled | N | Y |
| auto_ | Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled | N | Y |
auto_approve_personal_access_token_requests.disable
#Description
Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
YARA-L #
T1562↳ also matches auto_approve_personal_access_token_requests.enable
auto_approve_personal_access_token_requests.enable
#Description
Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
YARA-L #
T1562↳ also matches auto_approve_personal_access_token_requests.disable