Private Repository Forking
| action | Description | Sample | Rule |
|---|---|---|---|
| private_ | An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. | Y | Y |
| private_ | An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked. | Y | N |
| private_ | An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked. | Y | Y |
private_repository_forking.clear
#Description
An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783955169330,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMjU=",
"action": "private_repository_forking.clear",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955169330,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE09A6E:F2C6E08:6A54FEE1",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
Detection Rules #
Sigma #
T1020, T1537↳ also matches private_repository_forking.enable
private_repository_forking.disable
#Description
An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783909277248,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDI=",
"action": "private_repository_forking.disable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783909277248,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9EB02F:ADB2541:6A544B9D",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
private_repository_forking.enable
#Description
An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1783909276895,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDM=",
"action": "private_repository_forking.enable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783909276895,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"policy": "enterprise_organizations",
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9EAE7E:ADB23AB:6A544B9C",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
Detection Rules #
Sigma #
T1020, T1537↳ also matches private_repository_forking.clear