detection.wiki

Issue

actionDescriptionSampleRule
issue.destroyAn issue was deleted from the repository.YN
issue.pinnedAn issue was pinned to a repository.YN
issue.transferAn issue was transferred to another repository.YN
issue.unpinnedAn issue was unpinned from a repository.YN

issue.destroy

#
Category
issue

Description

An issue was deleted from the repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783958444334,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNDA=",
  "action": "issue.destroy",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783958441000,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "number": 4,
  "operation_type": "remove",
  "org": "example-org",
  "org_id": 9000004,
  "owner_type": "Organization",
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000016,
  "request_access_security_header": null,
  "request_id": "9722:205095:E70DEFC:EBE2C8D:6A550BAA",
  "title": "dw-harn-transfer-issue",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

issue.pinned

#
Category
issue

Description

An issue was pinned to a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783958438900,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNDc=",
  "action": "issue.pinned",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783958438000,
  "event": "pinned",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "number": 1,
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "owner_type": "Organization",
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000016,
  "request_access_security_header": null,
  "request_id": "9722:205095:E70C592:EBE12EA:6A550BA6",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

issue.transfer

#
Category
issue

Description

An issue was transferred to another repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783958443962,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNDE=",
  "action": "issue.transfer",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783958441000,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "number": 4,
  "operation_type": "transfer",
  "org": "example-org",
  "org_id": 9000004,
  "owner_type": "Organization",
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000016,
  "request_access_security_header": null,
  "request_id": "9722:205095:E70DEFC:EBE2C8D:6A550BAA",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

issue.unpinned

#
Category
issue

Description

An issue was unpinned from a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783958439385,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNDY=",
  "action": "issue.unpinned",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783958438000,
  "event": "unpinned",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "number": 1,
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "owner_type": "Organization",
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000016,
  "request_access_security_header": null,
  "request_id": "9722:205095:E70C911:EBE16A1:6A550BA7",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

References #