Pull Request

action	Description	Sample	Rule
pull_request.close	A pull request was closed without being merged.	Y	Y
pull_request.converted_to_draft	A pull request was converted to a draft.	Y	N
pull_request.create	A pull request was created.	Y	Y
pull_request.create_review_request	A review was requested on a pull request.	Y	N
pull_request.in_progress	A pull request was marked as in progress.	N	N
pull_request.indirect_merge	A pull request was considered merged because the pull request's commits were merged into the target branch.	Y	N
pull_request.merge	A pull request was merged.	Y	Y
pull_request.ready_for_review	A pull request was marked as ready for review.	Y	N
pull_request.rebase	A pull request was rebased.	Y	N
pull_request.remove_review_request	A review request was removed from a pull request.	Y	N
pull_request.reopen	A pull request was reopened after previously being closed.	Y	N

pull_request.close

Category: pull-request

Description

A pull request was closed without being merged.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000218,
  "user_id": 9000060,
  "actor_id": 9000060,
  "created_at": 1785258611420.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000219,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.close",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000220,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-81/pull/419",
  "pull_request_title": "Example pull request title 29",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

High Number of Closed Pull Requests by User source medium: Detects a high number of closed pull requests by a single user within a short time frame. Adversaries may close multiple pull requests to disrupt development workflows or hide malicious changes.T1020, T1485, T1565, T1565.001, T1567, T1567.001

References #

Humpty from IRCC

pull_request.converted_to_draft

Category: pull-request

Description

A pull request was converted to a draft.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000112,
  "user_id": 9000221,
  "actor_id": 9000221,
  "created_at": 1785274374370.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000222,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.converted_to_draft",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000223,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-business-1/example-repo-27/pull/16752",
  "pull_request_title": "Example pull request title 28",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

pull_request.create

Category: pull-request

Description

A pull request was created.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000224,
  "user_id": 9000165,
  "actor_id": 9000165,
  "token_id": 9000225,
  "created_at": 1785240063731.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000226,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.create",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000227,
  "user_agent": "GitHub CLI 2.96.0 Agent/kiro",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNw==",
  "token_scopes": "audit_log,project,read:org,read:user,repo,workflow",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-176/pull/66",
  "pull_request_title": "Example pull request title 31",
  "external_identity_nameid": "user",
  "programmatic_access_type": "Personal access token (classic)",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GitHub - pull request was created source medium: Detect activities when a pull request was created. This query runs every day and its severity is Medium.T1078

References #

Humpty from IRCC

pull_request.create_review_request

Category: pull-request

Description

A review was requested on a pull request.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000228,
  "user_id": 9000229,
  "actor_id": 9000230,
  "token_id": 9000231,
  "created_at": 1785239189308.0,
  "business_id": 9000005,
  "public_repo": false,
  "reviewer_id": 9000229,
  "actor_is_bot": true,
  "actor_is_agent": true,
  "pull_request_id": 9000232,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.create_review_request",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "reviewer": "user",
  "request_id": 9000233,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxOA==",
  "reviewer_type": "User",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-147/pull/480",
  "pull_request_title": "Example pull request title 23",
  "programmatic_access_type": "GitHub App server-to-server token"
}

References #

Humpty from IRCC

pull_request.in_progress

Category: pull-request

Description

A pull request was marked as in progress.

Documented on GitHub's enterprise audit log reference.

pull_request.indirect_merge

Category: pull-request

Description

A pull request was considered merged because the pull request's commits were merged into the target branch.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000234,
  "user_id": 9000041,
  "actor_id": 9000041,
  "created_at": 1782846210715.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000235,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "topic": "example-label-115",
  "action": "pull_request.indirect_merge",
  "business": "example-business",
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-175/pull/724",
  "pull_request_title": "Example pull request title 30",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

pull_request.merge

Category: pull-request

Description

A pull request was merged.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000236,
  "user_id": 9000237,
  "actor_id": 9000237,
  "created_at": 1785239585010.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000238,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.merge",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000239,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-144/pull/2302",
  "pull_request_title": "Example pull request title 27",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GitHub - pull request was merged source medium: Detect activities when a pull request was merged. This query runs every day and its severity is Medium.T1078

References #

Humpty from IRCC

pull_request.ready_for_review

Category: pull-request

Description

A pull request was marked as ready for review.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000240,
  "user_id": 9000241,
  "actor_id": 9000241,
  "created_at": 1785240760616.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000242,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.ready_for_review",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000243,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-114/pull/9052",
  "pull_request_title": "Example pull request title 26",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

pull_request.rebase

Category: pull-request

Description

A pull request was rebased.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000244,
  "user_id": 9000060,
  "actor_id": 9000060,
  "created_at": 1785264905061.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000245,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.rebase",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000246,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-74/pull/753",
  "pull_request_title": "Example pull request title 9",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

pull_request.remove_review_request

Category: pull-request

Description

A review request was removed from a pull request.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000247,
  "user_id": 9000047,
  "actor_id": 9000047,
  "created_at": 1785274780803.0,
  "business_id": 9000005,
  "public_repo": false,
  "reviewer_id": 9000248,
  "actor_is_bot": false,
  "pull_request_id": 9000249,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.remove_review_request",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "reviewer": "example-org-1/example-team-1",
  "request_id": 9000250,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "reviewer_type": "Team",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-72/pull/422",
  "pull_request_title": "Example pull request title 13",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

pull_request.reopen

Category: pull-request

Description

A pull request was reopened after previously being closed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000247,
  "user_id": 9000121,
  "actor_id": 9000047,
  "created_at": 1785261869357.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_id": 9000251,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "pull_request.reopen",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000252,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "pull_request_url": "https://example.invalid/example-org-1/example-repo-72/pull/403",
  "pull_request_title": "Example pull request title 6",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC