Integration Installation operations

action	Description	Sample	Rule
integration_installation.create	A GitHub App was installed.	Y	Y
integration_installation.destroy	A GitHub App was uninstalled.	Y	Y
integration_installation.repositories_added	Repositories were added to a GitHub App.	Y	Y
integration_installation.repositories_removed	Repositories were removed from a GitHub App.	Y	Y
integration_installation.suspend	A GitHub App was suspended.	N	Y
integration_installation.unsuspend	A GitHub App was unsuspended.	N	Y
integration_installation.version_updated	Permissions for a GitHub App were updated.	Y	Y

integration_installation.create

Category: integration-installation

Description

A GitHub App was installed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "actor_id": 9000089,
  "created_at": 1784839547336.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "example-label-104",
  "actor": "user",
  "action": "integration_installation.create",
  "business": "example-business",
  "request_id": 9000090,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "integration": "example-label-104",
  "permissions": {
    "contents": "read",
    "issues": "read",
    "metadata": "read",
    "pull_requests": "read"
  },
  "operation_type": "create",
  "repository_selection": "selected",
  "application_client_id": "Iv23xZySlkAppId",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.destroy, integration_installation.repositories_added, integration_installation.repositories_removed, integration_installation.suspend, integration_installation.unsuspend, integration_installation.version_updated
New GitHub App Installed source medium: This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.T1072, T1098, T1199

YARA-L #

GitHub Application Installed source low: Detects when a GitHub application is installed within an organization. An untrusted application can be installed and granted permissions to access data within a GitHub organization.

Panther #

Github Organization App Integration Installed source low: An application integration was installed to your organization's Github account by someone in your organization.

References #

Humpty from IRCC

integration_installation.destroy

#

Category: integration-installation

Description

A GitHub App was uninstalled.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "actor_id": 9000051,
  "created_at": 1780767558817.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "example-label-139",
  "actor": "user",
  "action": "integration_installation.destroy",
  "business": "example-business",
  "request_id": 9000091,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "integration": "example-label-139",
  "permissions": {
    "checks": "write",
    "contents": "write",
    "members": "read",
    "metadata": "read",
    "pull_requests": "write",
    "single_file": "write",
    "statuses": "write"
  },
  "operation_type": "remove",
  "repository_selection": "selected",
  "application_client_id": "Iv23xZySlkAppId",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.repositories_added, integration_installation.repositories_removed, integration_installation.suspend, integration_installation.unsuspend, integration_installation.version_updated

References #

Humpty from IRCC

integration_installation.repositories_added

#

Category: integration-installation

Description

Repositories were added to a GitHub App.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000092,
  "actor_id": 9000093,
  "created_at": 1783271786008.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "example-label-141",
  "actor": "user",
  "action": "integration_installation.repositories_added",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000094,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "integration": "example-label-141",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "repositories_added": [
    1290186378
  ],
  "repository_selection": "all",
  "application_client_id": "Iv23xZySlkAppId",
  "external_identity_nameid": "user",
  "repositories_added_names": [
    "example-org-8/example-repo-31"
  ],
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.destroy, integration_installation.repositories_removed, integration_installation.suspend, integration_installation.unsuspend, integration_installation.version_updated

References #

Humpty from IRCC

integration_installation.repositories_removed

#

Category: integration-installation

Description

Repositories were removed from a GitHub App.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000092,
  "actor_id": 9000093,
  "created_at": 1783272077202.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "example-label-140",
  "actor": "user",
  "topic": "example-label-107",
  "action": "integration_installation.repositories_removed",
  "business": "example-business",
  "integration": "example-label-140",
  "operation_type": "remove",
  "repositories_removed": [
    9000095
  ],
  "repository_selection": "all",
  "application_client_id": "Iv23xZySlkAppId",
  "external_identity_nameid": "user",
  "external_identity_username": "user",
  "repositories_removed_names": [
    "user/example-repo"
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.destroy, integration_installation.repositories_added, integration_installation.suspend, integration_installation.unsuspend, integration_installation.version_updated

References #

Humpty from IRCC

integration_installation.suspend

#

Category: integration-installation

Description

A GitHub App was suspended.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.destroy, integration_installation.repositories_added, integration_installation.repositories_removed, integration_installation.unsuspend, integration_installation.version_updated

integration_installation.unsuspend

#

Category: integration-installation

Description

A GitHub App was unsuspended.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.destroy, integration_installation.repositories_added, integration_installation.repositories_removed, integration_installation.suspend, integration_installation.version_updated

integration_installation.version_updated

#

Category: integration-installation

Description

Permissions for a GitHub App were updated.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "actor_id": 9000051,
  "created_at": 1780767535946.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "example-label-138",
  "actor": "user",
  "action": "integration_installation.version_updated",
  "business": "example-business",
  "request_id": 9000096,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "integration": "example-label-138",
  "operation_type": "modify",
  "permissions_added": {
    "statuses": "read"
  },
  "repository_selection": "selected",
  "application_client_id": "Iv23xZySlkAppId",
  "permissions_unchanged": {
    "actions": "write",
    "checks": "write",
    "contents": "write",
    "discussions": "write",
    "issues": "write",
    "members": "read",
    "metadata": "read",
    "pull_requests": "write",
    "repository_hooks": "write",
    "workflows": "write"
  },
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub App Deleted source low category-level: Detects the deletion of a GitHub app either from a repo or an organization.T1562, T1562.001, T1648↳ also matches integration_installation.create, integration_installation.destroy, integration_installation.repositories_added, integration_installation.repositories_removed, integration_installation.suspend, integration_installation.unsuspend

References #

Humpty from IRCC

Integration Installation

integration_installation.create

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

YARA-L #

Panther #

References #

integration_installation.destroy

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

References #

integration_installation.repositories_added

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

References #

integration_installation.repositories_removed

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

References #

integration_installation.suspend

Description

Related events #

Detection Rules #

Elastic #

integration_installation.unsuspend

Description

Related events #

Detection Rules #

Elastic #

integration_installation.version_updated

Description

Example Audit Log Entry #

Related events #

Detection Rules #

Elastic #

References #