detection.wiki

Project

actionDescriptionSampleRule
project.accessA project board visibility was changed.NN
project.closeA project board was closed.YN
project.createA project board was created.YN
project.deleteA project board was deleted.NY
project.linkA repository was linked to a project board.NN
project.openA project board was reopened.YN
project.renameA project board was renamed.NN
project.unlinkA repository was unlinked from a project board.NN
project.update_org_permissionThe project's base-level permission for all organization members was changed or removed.NN
project.update_team_permissionA team's project board permission level was changed or when a team was added or removed from a project board.NN
project.update_user_permissionA user was added to or removed from a project board or had their permission level changed.NY
project.visibility_privateA project's visibility was changed from public to private.YN
project.visibility_publicA project's visibility was changed from private to public.YN

project.access

#
Category
project

Description

A project board visibility was changed.

Documented on GitHub's enterprise audit log reference.

project.close

#
Category
project

Description

A project board was closed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783955178989,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDM=",
  "action": "project.close",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955178989,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "project_id": 9000007,
  "project_kind": "MemexProject",
  "project_name": "dw-harn-renamed",
  "public_project": false,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0CD37:F2CA191:6A54FEEA",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

project.create

#
Category
project

Description

A project board was created.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783955177046,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDc=",
  "action": "project.create",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955177046,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "create",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0C184:F2C95A7:6A54FEE8",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

project.delete

#
Category
project

Description

A project board was deleted.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

project.link

#
Category
project

Documented on GitHub's enterprise audit log reference.

project.open

#
Category
project

Description

A project board was reopened.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783955179386,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDI=",
  "action": "project.open",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955179386,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "project_id": 9000007,
  "project_kind": "MemexProject",
  "project_name": "dw-harn-renamed",
  "public_project": false,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0CF81:F2CA3EE:6A54FEEB",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

project.rename

#
Category
project

Description

A project board was renamed.

Documented on GitHub's enterprise audit log reference.

project.unlink

#
Category
project

Documented on GitHub's enterprise audit log reference.

project.update_org_permission

#
Category
project

Description

The project's base-level permission for all organization members was changed or removed.

Documented on GitHub's enterprise audit log reference.

project.update_team_permission

#
Category
project

Description

A team's project board permission level was changed or when a team was added or removed from a project board.

Documented on GitHub's enterprise audit log reference.

project.update_user_permission

#
Category
project

Description

A user was added to or removed from a project board or had their permission level changed.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

  • Github Outside Collaborator Detected source medium: Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.T1098, T1098.001, T1098.003, T1213, T1213.003

project.visibility_private

#
Category
project

Description

A project's visibility was changed from public to private.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783955178548,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDQ=",
  "action": "project.visibility_private",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955178548,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "project_id": 9000007,
  "project_kind": "MemexProject",
  "project_name": "dw-harn-renamed",
  "public_project": false,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0CB65:F2C9FBE:6A54FEEA",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

project.visibility_public

#
Category
project

Description

A project's visibility was changed from private to public.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783955178106,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDU=",
  "action": "project.visibility_public",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955178106,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "project_id": 9000007,
  "project_kind": "MemexProject",
  "project_name": "dw-harn-renamed",
  "public_project": true,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0C8C9:F2C9D2C:6A54FEE9",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #