Repository Branch Protection Evaluation
| action | Description | Sample | Rule |
|---|---|---|---|
| repository_ | Branch protections were disabled for the repository. | Y | Y |
| repository_ | Branch protections were enabled for this repository. | Y | N |
repository_branch_protection_evaluation.disable
#Description
Branch protections were disabled for the repository.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000336,
"user_id": 9000337,
"actor_id": 9000337,
"created_at": 1784045046032.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"user": "user",
"actor": "user",
"action": "repository_branch_protection_evaluation.disable",
"business": "example-business",
"request_id": 9000338,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
YARA-L #
T1562
repository_branch_protection_evaluation.enable
#Description
Branch protections were enabled for this repository.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000336,
"user_id": 9000337,
"actor_id": 9000337,
"created_at": 1784045087480.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"user": "user",
"actor": "user",
"action": "repository_branch_protection_evaluation.enable",
"business": "example-business",
"request_id": 9000339,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}