Repository Advisory
| action | Description | Sample | Rule |
|---|---|---|---|
| repository_ | Someone closed a security advisory. | Y | N |
| repository_ | Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory. | N | N |
| repository_ | GitHub made a security advisory public in the GitHub Advisory Database. | N | N |
| repository_ | GitHub withdrew a security advisory that was published in error. | N | N |
| repository_ | Someone opened a draft security advisory. | Y | N |
| repository_ | Someone published a security advisory. | N | N |
| repository_ | Someone reopened as draft security advisory. | N | N |
| repository_ | Someone edited a draft or published security advisory. | Y | N |
repository_advisory.close
#Description
Someone closed a security advisory.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000009,
"actor_id": 9000010,
"created_at": 1783936236795.0,
"business_id": 9000005,
"public_repo": true,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"action": "repository_advisory.close",
"business": "example-business",
"request_id": 9000335,
"user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"operation_type": "modify"
}
References #
repository_advisory.cve_request
#Description
Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.
Documented on GitHub's enterprise audit log reference.
repository_advisory.github_broadcast
#Description
GitHub made a security advisory public in the GitHub Advisory Database.
Documented on GitHub's enterprise audit log reference.
repository_advisory.github_withdraw
#Description
GitHub withdrew a security advisory that was published in error.
Documented on GitHub's enterprise audit log reference.
repository_advisory.open
#Description
Someone opened a draft security advisory.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000013,
"actor_id": 9000014,
"token_id": 9000015,
"created_at": 1781910954287.0,
"business_id": 9000005,
"public_repo": true,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"action": "repository_advisory.open",
"business": "example-business",
"request_id": 9000017,
"user_agent": "weekly-reporter",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMg==",
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"operation_type": "create",
"programmatic_access_type": "Personal access token (classic)"
}
References #
repository_advisory.publish
#Description
Someone published a security advisory.
Documented on GitHub's enterprise audit log reference.
repository_advisory.reopen
#Description
Someone reopened as draft security advisory.
Documented on GitHub's enterprise audit log reference.
repository_advisory.update
#Description
Someone edited a draft or published security advisory.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000013,
"actor_id": 9000014,
"token_id": 9000015,
"created_at": 1781910954196.0,
"business_id": 9000005,
"public_repo": true,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"action": "repository_advisory.update",
"business": "example-business",
"request_id": 9000017,
"user_agent": "weekly-reporter",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMg==",
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"operation_type": "modify",
"programmatic_access_type": "Personal access token (classic)"
}
References #