Dependabot Alerts

action	Description	Sample	Rule
dependabot_alerts.disable	Dependabot alerts were disabled for all existing repositories.	N	Y
dependabot_alerts.enable	Dependabot alerts were enabled for all existing repositories.	N	N

dependabot_alerts.disable

Category: dependabot-alerts

Description

Dependabot alerts were disabled for all existing repositories.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Outdated Dependency Or Vulnerability Alert Disabled source high: Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.T1195, T1195.001

YARA-L #

GitHub Dependabot Vulnerability Alerts Disabled source high: Detects when vulnerability alerts are disabled for GitHub Dependabot.T1562

Panther #

GitHub Security Change, includes GitHub Advanced Security source low: The rule alerts when GitHub Security tools (Dependabot, Secret Scanner, etc) are disabled.T1562

dependabot_alerts.enable

Category: dependabot-alerts

Description

Dependabot alerts were enabled for all existing repositories.

Documented on GitHub's enterprise audit log reference.