detection.wiki

Environment

actionDescriptionSampleRule
environment.add_protection_ruleA GitHub Actions deployment protection rule was created via the API.YN
environment.createYN
environment.create_actions_secretA secret was created for a GitHub Actions environment.YY
environment.create_actions_variableA variable was created for a GitHub Actions environment.YN
environment.deleteAn environment was deleted.YY
environment.remove_actions_secretA secret was deleted for a GitHub Actions environment.YN
environment.remove_actions_variableA variable was deleted for a GitHub Actions environment.YN
environment.remove_protection_ruleA GitHub Actions deployment protection rule was deleted via the API.YN
environment.update_actions_secretA secret was updated for a GitHub Actions environment.YN
environment.update_actions_variableA variable was updated for a GitHub Actions environment.YN
environment.update_protection_ruleA GitHub Actions deployment protection rule was updated via the API.YN

environment.add_protection_rule

#
Category
environment

Description

A GitHub Actions deployment protection rule was created via the API.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000054,
  "actor_id": 9000055,
  "created_at": 1784226407873.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.add_protection_rule",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000056,
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "environment_name": "example-label-98",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.create

#
Category
environment

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000057,
  "created_at": 1785262630948.0,
  "business_id": 9000005,
  "public_repo": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "action": "environment.create",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000058,
  "user_agent": "actions-run-service/9165d2b",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "environment_name": "copilot"
}

References #

environment.create_actions_secret

#
Category
environment

Description

A secret was created for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000059,
  "actor_id": 9000060,
  "created_at": 1785181441198.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "key": "DEPLOY_SYNTHETIC",
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.create_actions_secret",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000061,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "environment_name": "master",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

environment.create_actions_variable

#
Category
environment

Description

A variable was created for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000062,
  "actor_id": 9000063,
  "created_at": 1784817201182.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "key": "DEPLOY_SYNTHETIC",
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.create_actions_variable",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000064,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "environment_name": "example-label-133",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.delete

#
Category
environment

Description

An environment was deleted.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000062,
  "actor_id": 9000063,
  "created_at": 1784817150081.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.delete",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000065,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "environment_name": "example-label-97",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

environment.remove_actions_secret

#
Category
environment

Description

A secret was deleted for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000059,
  "actor_id": 9000060,
  "created_at": 1785182443164.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "key": "DEPLOY_SYNTHETIC",
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.remove_actions_secret",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000066,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "environment_name": "master",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.remove_actions_variable

#
Category
environment

Description

A variable was deleted for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783958483783,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMTk=",
  "action": "environment.remove_actions_variable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783958483783,
  "environment_name": "dw-harn-env",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "key": "DEPLOY_SYNTHETIC",
  "operation_type": "remove",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000009,
  "request_access_security_header": null,
  "request_id": "DB80:205095:E71DEAB:EBF300D:6A550BD3",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

environment.remove_protection_rule

#
Category
environment

Description

A GitHub Actions deployment protection rule was deleted via the API.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000067,
  "actor_id": 9000068,
  "created_at": 1781721354490.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.remove_protection_rule",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000069,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "environment_name": "example-label-96",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.update_actions_secret

#
Category
environment

Description

A secret was updated for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000070,
  "actor_id": 9000071,
  "created_at": 1781189279135.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "key": "DEPLOY_SYNTHETIC",
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.update_actions_secret",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000072,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "environment_name": "example-label-95",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.update_actions_variable

#
Category
environment

Description

A variable was updated for a GitHub Actions environment.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000062,
  "actor_id": 9000063,
  "created_at": 1784817054329.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "key": "DEPLOY_SYNTHETIC",
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.update_actions_variable",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000073,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "environment_name": "example-label-134",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

environment.update_protection_rule

#
Category
environment

Description

A GitHub Actions deployment protection rule was updated via the API.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000074,
  "actor_id": 9000075,
  "business_id": 9000005,
  "environment_id": 9000076,
  "prevent_self_review": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "environment.update_protection_rule",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "approvers": [
    {
      "team": "example-org-1/example-team-1",
      "team_id": 9000077
    }
  ],
  "request_id": 9000078,
  "user_agent": "go-github/v88.0.0",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwNw==",
  "approvers_was": [
    {
      "team": "example-org-1/example-team-1",
      "team_id": 9000077
    },
    {
      "user": "user",
      "user_id": 9000079
    }
  ],
  "actor_location": {
    "country_code": "XX"
  },
  "environment_name": "dep",
  "programmatic_access_type": "GitHub App server-to-server token"
}

References #