Git

action	Description	Sample	Rule
git.clone	A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.	Y	Y
git.fetch	Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.	Y	Y
git.push	Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.	Y	Y

git.clone

Category: git

Description

A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

GitHub Enterprise Cloud logs Git events by default, retrievable via the REST API or audit-log streaming only (not the web UI), with 7-day retention. GitHub Enterprise Server requires enabling Git events in audit-log configuration.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1785026871063,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDU=",
  "action": "example.invalid",
  "actor": "user",
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "repo": "user/example-repo",
  "repository": "user/example-repo",
  "repository_public": false,
  "token_id": 9000006,
  "transport_protocol": 1,
  "transport_protocol_name": "http",
  "user": "user",
  "user_agent": "git/2.39.5",
  "user_id": 9000007
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`github.repository_public` (elastic rule field)	eq	`false`	2 rules	elastic
`github.programmatic_access_type` (elastic rule field)	in	`fine-grained personal access token`	1 rule	elastic
`github.programmatic_access_type` (elastic rule field)	in	`oauth access token`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

High Number of Cloned GitHub Repos From PAT source low: Detects a high number of unique private repo clone events originating from a single personal access token within a short time period.T1213, T1213.003, T1648
GitHub Exfiltration via High Number of Repository Clones by User source medium: Detects a high number of repository cloning actions by a single user within a short time frame. Adversaries may clone multiple repositories to exfiltrate sensitive data.T1020, T1213, T1213.003, T1567, T1567.001
Github Activity on a Private Repository from an Unusual IP source low: Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.T1059, T1078, T1078.004, T1195, T1195.002, T1213↳ also matches git.push

YARA-L #

GitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories source high: Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.T1213
GitHub High Number Of Non Public GitHub Repositories Cloned source high: Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.T1213

Panther #

GitHub User Initial Access to Private Repo source informational: Detects when a user initially accesses a private organization repository.↳ also matches git.fetch, git.push

git.fetch

Category: git

Description

Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1785027127063,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDQ=",
  "action": "example.invalid",
  "actor": "user",
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "repo": "user/example-repo",
  "repository": "user/example-repo",
  "repository_public": false,
  "token_id": 9000006,
  "transport_protocol": 1,
  "transport_protocol_name": "http",
  "user": "user",
  "user_agent": "git/2.39.5",
  "user_id": 9000007
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GitHub User Initial Access to Private Repo source informational: Detects when a user initially accesses a private organization repository.↳ also matches git.clone, git.push

git.push

Category: git

Description

Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1785026872972,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDQ=",
  "action": "example.invalid",
  "actor": "user",
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "repo": "user/example-repo",
  "repository": "user/example-repo",
  "repository_public": false,
  "token_id": 9000006,
  "transport_protocol": 1,
  "transport_protocol_name": "http",
  "user": "user",
  "user_agent": "git/2.39.5",
  "user_id": 9000007
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`github.repository_public` (elastic rule field)	eq	`false`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Actions Unusual Bot Push to Repository source low: Detects when the github-actions[bot] pushes code to a repository where it has not performed this behavior before in a certain time window. This may indicate a supply chain attack where malicious code running in a CI workflow attempts to modify repository contents, such as injecting backdoor workflow files.T1059, T1195, T1195.002, T1565, T1565.001
Github Activity on a Private Repository from an Unusual IP source low: Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.T1059, T1078, T1078.004, T1195, T1195.002, T1213↳ also matches git.clone

Panther #

GitHub User Initial Access to Private Repo source informational: Detects when a user initially accesses a private organization repository.↳ also matches git.clone, git.fetch

References #

Sample log: detection.wiki first-party GHEC capture (identifiers scrubbed)

Git

git.clone

Description

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

YARA-L #

Panther #

git.fetch

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Panther #

git.push

Description

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Panther #

References #