GitHub-protected-branch

2 operations, identified by action in the audit log.

action	Description
protected_branch.policy_override	A branch protection requirement was overridden by a repository administrator.
protected_branch.rejected_ref_update	A branch update attempt was rejected.

protected_branch.policy_override

Category: GitHub-protected-branch

Description

A branch protection requirement was overridden by a repository administrator.

Fields #

Name	Description
`action`	The audit-log action string (e.g. repo.create).
`actor`	Login of the user (or app) that performed the action.
`actor_id`	Numeric ID of the actor.
`user`	Login of the user the action targeted, when applicable.
`org`	Organization in which the action occurred.
`repo`	Repository the action targeted (owner/name), when applicable.
`business`	Enterprise account, when the org belongs to one.
`@timestamp`	Time the event was recorded (epoch ms).
`created_at`	Time the action occurred (epoch ms).
`operation_type`	Operation class: create, modify, remove, access, transfer, authentication.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Esql.event_count`	ge	`10`	1 rule	elastic
`github.category`	eq	`protected_branch`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

High Number of Protected Branch Force Pushes by User source medium: Detects a high number of force push actions to protected branches by a single user within a short time frame. Adversaries may perform force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.

protected_branch.rejected_ref_update

Category: GitHub-protected-branch

Description

A branch update attempt was rejected.

Fields #

Name	Description
`action`	The audit-log action string (e.g. repo.create).
`actor`	Login of the user (or app) that performed the action.
`actor_id`	Numeric ID of the actor.
`user`	Login of the user the action targeted, when applicable.
`org`	Organization in which the action occurred.
`repo`	Repository the action targeted (owner/name), when applicable.
`business`	Enterprise account, when the org belongs to one.
`@timestamp`	Time the event was recorded (epoch ms).
`created_at`	Time the action occurred (epoch ms).
`operation_type`	Operation class: create, modify, remove, access, transfer, authentication.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType`	eq	`protected_branch.rejected_ref_update`	2 rules	elastic
`github.category`	eq	`protected_branch`	2 rules	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Several Failed Protected Branch Force Pushes by User source medium: Detects a high number of failed force push attempts to protected branches by a single user within a short time frame. Adversaries may attempt multiple force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.
GitHub Actions Workflow Modification Blocked source medium: Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

GitHub-protected-branch

protected_branch.policy_override

Description

Fields #

Common Indicators #

Detection Rules #

Elastic #

protected_branch.rejected_ref_update

Description

Fields #

Common Indicators #

Detection Rules #

Elastic #

Keyboard shortcuts

Search operators