IP Allow List Entry
| action | Description | Sample | Rule |
|---|---|---|---|
| ip_ | An IP address was added to an IP allow list. | Y | Y |
| ip_ | An IP address was deleted from an IP allow list. | Y | Y |
| ip_ | An IP address or its description was changed. | Y | Y |
ip_allow_list_entry.create
#Description
An IP address was added to an IP allow list.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783955170382,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjc=",
"action": "ip_allow_list_entry.create",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170382,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "create",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A048:F2C73E5:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.destroy, ip_allow_list_entry.update
ip_allow_list_entry.destroy
#Description
An IP address was deleted from an IP allow list.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783955170926,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjU=",
"action": "ip_allow_list_entry.destroy",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170926,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "remove",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A3C0:F2C7753:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.create, ip_allow_list_entry.update
ip_allow_list_entry.update
#Description
An IP address or its description was changed.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783955170652,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjY=",
"action": "ip_allow_list_entry.update",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170652,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A239:F2C75D9:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.create, ip_allow_list_entry.destroy