OAuth Application
| action | Description | Sample | Rule |
|---|---|---|---|
| oauth_ | An OAuth application was created. | N | N |
| oauth_ | An OAuth application was deleted. | N | N |
| oauth_ | An OAuth application's secret key was generated. | N | N |
| oauth_ | An OAuth application's secret key was deleted. | N | Y |
| oauth_ | The secret key for an OAuth application was reset. | N | N |
| oauth_ | All user tokens for an OAuth application were requested to be revoked. | N | N |
| oauth_ | Token(s) for an OAuth application were revoked. | N | N |
| oauth_ | An OAuth application was transferred from one account to another. | N | N |
oauth_application.create
#Description
An OAuth application was created.
Documented on GitHub's enterprise audit log reference.
oauth_application.destroy
#Description
An OAuth application was deleted.
Documented on GitHub's enterprise audit log reference.
oauth_application.generate_client_secret
#Description
An OAuth application's secret key was generated.
Documented on GitHub's enterprise audit log reference.
oauth_application.remove_client_secret
#Description
An OAuth application's secret key was deleted.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Kusto #
T1078
oauth_application.reset_secret
#Description
The secret key for an OAuth application was reset.
Documented on GitHub's enterprise audit log reference.
oauth_application.revoke_all_tokens
#Description
All user tokens for an OAuth application were requested to be revoked.
Documented on GitHub's enterprise audit log reference.
oauth_application.revoke_tokens
#Description
Token(s) for an OAuth application were revoked.
Documented on GitHub's enterprise audit log reference.
oauth_application.transfer
#Description
An OAuth application was transferred from one account to another.
Documented on GitHub's enterprise audit log reference.