Business Advanced Security
| action | Description | Sample | Rule |
|---|---|---|---|
| business_ | GitHub Advanced Security was disabled for your enterprise. | N | Y |
| business_ | GitHub Advanced Security was disabled for new repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was disabled for new user namespace repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was enabled for your enterprise. | N | N |
| business_ | GitHub Advanced Security was enabled for new repositories in your enterprise. | N | N |
| business_ | GitHub Advanced Security was enabled for new user namespace repositories in your enterprise. | N | N |
| business_ | GitHub Advanced Security was disabled for user namespace repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was enabled for user namespace repositories in your enterprise. | N | N |
business_advanced_security.disabled
#Description
GitHub Advanced Security was disabled for your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled_for_new_repos, business_advanced_security.disabled_for_new_user_namespace_repos, business_advanced_security.user_namespace_repos_disabled Panther #
T1562↳ also matches business_advanced_security.disabled_for_new_repos
business_advanced_security.disabled_for_new_repos
#Description
GitHub Advanced Security was disabled for new repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_user_namespace_repos, business_advanced_security.user_namespace_repos_disabled Panther #
T1562↳ also matches business_advanced_security.disabled
business_advanced_security.disabled_for_new_user_namespace_repos
#Description
GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_repos, business_advanced_security.user_namespace_repos_disabled
business_advanced_security.enabled
#Description
GitHub Advanced Security was enabled for your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.enabled_for_new_repos
#Description
GitHub Advanced Security was enabled for new repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.enabled_for_new_user_namespace_repos
#Description
GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.user_namespace_repos_disabled
#Description
GitHub Advanced Security was disabled for user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_repos, business_advanced_security.disabled_for_new_user_namespace_repos
business_advanced_security.user_namespace_repos_enabled
#Description
GitHub Advanced Security was enabled for user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.