detection.wiki

Personal Access Token

actionDescriptionSampleRule
personal_access_token.access_grantedA fine-grained personal access token was granted access to resources.YY
personal_access_token.access_restriction_disabledThe configured restriction for access to resources via personal access tokens was disabled.NN
personal_access_token.access_restriction_enabledThe configured restriction for access to resources via personal access tokens was enabled.NN
personal_access_token.access_restriction_resetThe configured restriction for access to resources via personal access tokens was reset and delegated to organizations.NN
personal_access_token.access_revokedA fine-grained personal access token was revoked. The token can still read public organization resources.YY
personal_access_token.auto_approve_grant_requests_disabledTriggered when fine-grained personal access tokens can access organization resources without prior approval.NN
personal_access_token.auto_approve_grant_requests_enabledTriggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.NN
personal_access_token.auto_approve_grant_requests_resetTriggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.NN
personal_access_token.createTriggered when you create a fine-grained personal access token.YN
personal_access_token.credential_regeneratedTriggered when you regenerate a fine-grained personal access token.YN
personal_access_token.credential_revokedA fine-grained personal access token was revoked by GitHub Advanced Security.NN
personal_access_token.destroyTriggered when you delete a fine-grained personal access token.YN
personal_access_token.expiration_limit_setA personal access token expiration limit was set.YN
personal_access_token.expiration_limit_unsetA personal access token expiration limit was unset.YN
personal_access_token.request_cancelledA pending request for a fine-grained personal access token to access organization resources was canceled.NN
personal_access_token.request_createdTriggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.YY
personal_access_token.request_deniedA request for a fine-grained personal access token to access organization resources was denied.NN
personal_access_token.updateA fine-grained personal access token was updated.NN

personal_access_token.access_granted

#
Category
personal-access-token

Description

A fine-grained personal access token was granted access to resources.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "user_id": 9000031,
  "actor_id": 9000031,
  "token_id": 9000170,
  "created_at": 1785268178962.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "user_programmatic_access_id": 9000170,
  "org": "example-org",
  "user": "user",
  "actor": "user",
  "action": "personal_access_token.access_granted",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000171,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "permissions": {
    "members": "write",
    "organization_administration": "write"
  },
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "repository_selection": "none",
  "external_identity_nameid": "user",
  "external_identity_username": "user",
  "user_programmatic_access_name": "upload_automation_token"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

YARA-L #

References #

personal_access_token.access_restriction_disabled

#
Category
personal-access-token

Description

The configured restriction for access to resources via personal access tokens was disabled.

Documented on GitHub's enterprise audit log reference.

personal_access_token.access_restriction_enabled

#
Category
personal-access-token

Description

The configured restriction for access to resources via personal access tokens was enabled.

Documented on GitHub's enterprise audit log reference.

personal_access_token.access_restriction_reset

#
Category
personal-access-token

Description

The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

personal_access_token.access_revoked

#
Category
personal-access-token

Description

A fine-grained personal access token was revoked. The token can still read public organization resources.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000157,
  "user_id": 9000172,
  "actor_id": 9000172,
  "token_id": 9000173,
  "created_at": 1780348601721.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "user_programmatic_access_id": 9000173,
  "org": "example-org",
  "user": "user",
  "actor": "user",
  "action": "personal_access_token.access_revoked",
  "business": "example-business",
  "request_id": 9000174,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "permissions": {
    "discussions": "read",
    "environments": "read",
    "metadata": "read",
    "pages": "read",
    "repository_advisories": "read",
    "secret_scanning_alerts": "read"
  },
  "operation_type": "remove",
  "repository_selection": "all",
  "external_identity_nameid": "user",
  "external_identity_username": "user",
  "user_programmatic_access_name": "upload_automation_token"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

References #

personal_access_token.auto_approve_grant_requests_disabled

#
Category
personal-access-token

Description

Triggered when fine-grained personal access tokens can access organization resources without prior approval.

Documented on GitHub's enterprise audit log reference.

personal_access_token.auto_approve_grant_requests_enabled

#
Category
personal-access-token

Description

Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.

Documented on GitHub's enterprise audit log reference.

personal_access_token.auto_approve_grant_requests_reset

#
Category
personal-access-token

Description

Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

personal_access_token.create

#
Category
personal-access-token

Description

Triggered when you create a fine-grained personal access token.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1772944954090,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAyMg==",
  "action": "personal_access_token.create",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1772944954090,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMwAAAAAAAAA=",
  "operation_type": "create",
  "permissions_added": {
    "contents": "write",
    "metadata": "read"
  },
  "programmatic_access_type": "Fine-grained personal access token",
  "repository_selection": "subset",
  "request_access_security_header": null,
  "request_id": "D389:153D:193A1B5:19EA448:69ACFE38",
  "token_id": 9300000001,
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
  "user_id": 9000002,
  "user_programmatic_access_name": "upload_automation_token"
}

References #

personal_access_token.credential_regenerated

#
Category
personal-access-token

Description

Triggered when you regenerate a fine-grained personal access token.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1773088564941,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAyMw==",
  "action": "personal_access_token.credential_regenerated",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1773088564941,
  "operation_type": "modify",
  "request_access_security_header": null,
  "request_id": "FE0C:1C06C7:CA899E:118CD69:69AF2F2B",
  "token_id": 9300000001,
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
  "user_id": 9000002,
  "user_programmatic_access_name": "upload_automation_token"
}

References #

personal_access_token.credential_revoked

#
Category
personal-access-token

Description

A fine-grained personal access token was revoked by GitHub Advanced Security.

Documented on GitHub's user audit log reference.

personal_access_token.destroy

#
Category
personal-access-token

Description

Triggered when you delete a fine-grained personal access token.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1780327349776,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAyNA==",
  "action": "personal_access_token.destroy",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1780327349776,
  "explanation": "web_user",
  "operation_type": "remove",
  "request_access_security_header": null,
  "request_id": "F1FE:66A6:12058F0C:12462B9F:6A1DA3AE",
  "token_id": 9300000001,
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0",
  "user_id": 9000002,
  "user_programmatic_access_name": "upload_automation_token"
}

References #

personal_access_token.expiration_limit_set

#
Category
personal-access-token

Description

A personal access token expiration limit was set.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "actor_id": 9000047,
  "created_at": 1781535426535.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "token_expiration": 366.0,
  "exempt_administrators": false,
  "org": "example-org",
  "actor": "user",
  "action": "personal_access_token.expiration_limit_set",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000175,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "programmatic_access_type": "personal access tokens (classic)",
  "external_identity_username": "user"
}

References #

personal_access_token.expiration_limit_unset

#
Category
personal-access-token

Description

A personal access token expiration limit was unset.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "actor_id": 9000047,
  "created_at": 1781539318657.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "old_token_expiration": 366.0,
  "org": "example-org",
  "actor": "user",
  "action": "personal_access_token.expiration_limit_unset",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000176,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "external_identity_nameid": "user",
  "programmatic_access_type": "personal access tokens (classic)",
  "external_identity_username": "user"
}

References #

personal_access_token.request_cancelled

#
Category
personal-access-token

Description

A pending request for a fine-grained personal access token to access organization resources was canceled.

Documented on GitHub's enterprise audit log reference.

personal_access_token.request_created

#
Category
personal-access-token

Description

Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "user_id": 9000031,
  "actor_id": 9000031,
  "token_id": 9000170,
  "created_at": 1785268178881.0,
  "business_id": 9000005,
  "actor_is_bot": false,
  "user_programmatic_access_id": 9000170,
  "user_programmatic_access_request_id": 9000177,
  "org": "example-org",
  "user": "user",
  "actor": "user",
  "action": "personal_access_token.request_created",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000171,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "permissions_added": {
    "members": "write"
  },
  "permissions_upgraded": {},
  "repository_selection": "none",
  "permissions_unchanged": {
    "organization_administration": "write"
  },
  "external_identity_nameid": "user",
  "external_identity_username": "user",
  "user_programmatic_access_name": "upload_automation_token"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
graph.metadata.entity_type (Chronicle)eqIP_ADDRESS1 rulechronicle
graph.metadata.product_name (Chronicle)eqGCTI Feed1 rulechronicle
graph.metadata.source_type (Chronicle)eqGLOBAL_CONTEXT1 rulechronicle
graph.metadata.threat.threat_feed_name (Chronicle)eqTor Exit Nodes1 rulechronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

References #

personal_access_token.request_denied

#
Category
personal-access-token

Description

A request for a fine-grained personal access token to access organization resources was denied.

Documented on GitHub's enterprise audit log reference.

personal_access_token.update

#
Category
personal-access-token

Description

A fine-grained personal access token was updated.

Documented on GitHub's user audit log reference.