Codespaces
| action | Description | Sample | Rule |
|---|---|---|---|
| codespaces. | A codespace using custom permissions from its devcontainer.json file was launched. | N | N |
| codespaces. | An attempt to create a codespace from a prebuild was made. | N | N |
| codespaces. | Enterprise setting for Codespaces ownership was updated. | N | N |
| codespaces. | Credentials for a codespace were refreshed. | N | N |
| codespaces. | A codespace was created | N | N |
| codespaces. | A user deleted a codespace. | N | Y |
| codespaces. | A codespace was exported to a branch on GitHub. | N | N |
| codespaces. | Policies were applied to codespaces in an organization or enterprise. | N | N |
| codespaces. | Policies were removed from codespaces in an organization or enterprise. | N | N |
| codespaces. | Policies were updated for codespaces in an organization or enterprise. | N | N |
| codespaces. | A codespace was restored. | N | N |
| codespaces. | A codespace was started. | N | N |
| codespaces. | A codespace was stopped. | N | N |
| codespaces. | A personal account's access and security setting for Codespaces were updated. | N | N |
codespaces.allow_permissions
#Description
A codespace using custom permissions from its devcontainer.json file was launched.
Documented on GitHub's enterprise audit log reference.
codespaces.attempted_to_create_from_prebuild
#Description
An attempt to create a codespace from a prebuild was made.
Documented on GitHub's enterprise audit log reference.
codespaces.business_enablement_updated
#Description
Enterprise setting for Codespaces ownership was updated.
Documented on GitHub's enterprise audit log reference.
codespaces.connect
#Description
Credentials for a codespace were refreshed.
Documented on GitHub's enterprise audit log reference.
codespaces.create
#Description
A codespace was created
Documented on GitHub's enterprise audit log reference.
codespaces.destroy
#Description
A user deleted a codespace.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Sigma #
T1213, T1213.003
codespaces.export_environment
#Description
A codespace was exported to a branch on GitHub.
Documented on GitHub's enterprise audit log reference.
codespaces.policy_group_created
#Description
Policies were applied to codespaces in an organization or enterprise.
Documented on GitHub's enterprise audit log reference.
codespaces.policy_group_deleted
#Description
Policies were removed from codespaces in an organization or enterprise.
Documented on GitHub's enterprise audit log reference.
codespaces.policy_group_updated
#Description
Policies were updated for codespaces in an organization or enterprise.
Documented on GitHub's enterprise audit log reference.
codespaces.restore
#Description
A codespace was restored.
Documented on GitHub's enterprise audit log reference.
codespaces.start_environment
#Description
A codespace was started.
Documented on GitHub's enterprise audit log reference.
codespaces.suspend_environment
#Description
A codespace was stopped.
Documented on GitHub's enterprise audit log reference.
codespaces.trusted_repositories_access_update
#Description
A personal account's access and security setting for Codespaces were updated.
Documented on GitHub's enterprise audit log reference.