Hook
| action | Description | Sample | Rule |
|---|---|---|---|
| hook. | A hook's active status was updated. | Y | Y |
| hook. | A hook's configuration was changed. | Y | Y |
| hook. | A new hook was added. | Y | Y |
| hook. | A hook was deleted. | Y | Y |
| hook. | A hook's configured events were changed. | Y | Y |
hook.active_changed
#Description
A hook's active status was updated.
Documented on GitHub's enterprise audit log reference. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783957676187,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjg=",
"action": "hook.active_changed",
"active": false,
"active_was": true,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"config": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://example.com/dw-harn"
},
"created_at": 1783957676187,
"events": [
"member",
"organization",
"push",
"repository",
"team"
],
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"hook_id": 9000010,
"name": "webhook",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "BF08:15A139:F700201:FBC9562:6A5508AC",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Common Indicators #
Field Kind Value Rules Vendors action (panther rule field)starts_with hook.2 rules panther Detection Rules #
Panther #
T1020↳ also matches hook.config_changed, hook.create, hook.destroy, hook.events_changed T1020↳ also matches hook.config_changed, hook.create, hook.destroy, hook.events_changed
hook.config_changed
#Description
A hook's configuration was changed.
Documented on GitHub's enterprise audit log reference. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783909272886,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDg=",
"action": "hook.config_changed",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"config": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://dw-harn-37cc4485-v2.example.com/webhook"
},
"config_was": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://dw-harn-37cc4485.example.com/webhook"
},
"created_at": 1783909272886,
"events": [
"pull_request",
"push"
],
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"hook_id": 9000017,
"name": "webhook",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9E9824:ADB0CFA:6A544B98",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Common Indicators #
Field Kind Value Rules Vendors action (panther rule field)starts_with hook.2 rules panther Detection Rules #
Panther #
T1020↳ also matches hook.active_changed, hook.create, hook.destroy, hook.events_changed T1020↳ also matches hook.active_changed, hook.create, hook.destroy, hook.events_changed
hook.create
#Description
A new hook was added.
Documented on GitHub's enterprise audit log reference. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783909275535,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDY=",
"action": "hook.create",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"config": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://dw-harn-37cc4485.example.com/repo-hook"
},
"created_at": 1783909275535,
"events": [
"issues"
],
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"hook_id": 9000018,
"name": "webhook",
"oauth_application": null,
"oauth_application_id": null,
"operation_type": "create",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"public_repo": false,
"repo": "user/example-repo",
"repo_id": 9000019,
"request_access_security_header": null,
"request_id": "9788:205095:A9EA627:ADB1B1A:6A544B9B",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Common Indicators #
Field Kind Value Rules Vendors action (panther rule field)starts_with hook.2 rules panther Detection Rules #
Panther #
T1020↳ also matches hook.active_changed, hook.config_changed, hook.destroy, hook.events_changed T1020↳ also matches hook.active_changed, hook.config_changed, hook.destroy, hook.events_changed
hook.destroy
#Description
A hook was deleted.
Documented on GitHub's enterprise audit log reference. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783909275808,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDU=",
"action": "hook.destroy",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"config": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://dw-harn-37cc4485.example.com/repo-hook"
},
"created_at": 1783909275808,
"events": [
"issues"
],
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"hook_id": 9000018,
"name": "webhook",
"operation_type": "remove",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"public_repo": false,
"repo": "user/example-repo",
"repo_id": 9000019,
"request_access_security_header": null,
"request_id": "9788:205095:A9EA786:ADB1D04:6A544B9B",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Common Indicators #
Field Kind Value Rules Vendors action (panther rule field)starts_with hook.2 rules panther Detection Rules #
Panther #
T1020↳ also matches hook.active_changed, hook.config_changed, hook.create, hook.events_changed T1020↳ also matches hook.active_changed, hook.config_changed, hook.create, hook.events_changed
hook.events_changed
#Description
A hook's configured events were changed.
Documented on GitHub's enterprise audit log reference. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783909272682,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDk=",
"action": "hook.events_changed",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"config": {
"content_type": "json",
"insecure_ssl": "0",
"url": "https://dw-harn-37cc4485.example.com/webhook"
},
"created_at": 1783909272682,
"events": [
"push",
"pull_request"
],
"events_were": [
"push"
],
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"hook_id": 9000017,
"name": "webhook",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9E9710:ADB0BD5:6A544B98",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Common Indicators #
Field Kind Value Rules Vendors action (panther rule field)starts_with hook.2 rules panther Detection Rules #
Panther #
T1020↳ also matches hook.active_changed, hook.config_changed, hook.create, hook.destroy T1020↳ also matches hook.active_changed, hook.config_changed, hook.create, hook.destroy