detection.wiki

Repository Ruleset

actionDescriptionSampleRule
repository_ruleset.createA repository ruleset was created.YY
repository_ruleset.destroyA repository ruleset was deleted.YY
repository_ruleset.updateA repository ruleset was edited.YY

repository_ruleset.create

#
Category
repository-ruleset

Description

A repository ruleset was created.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000348,
  "actor_id": 9000084,
  "created_at": 1785270361580.0,
  "ruleset_id": 9000350,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.create",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000351,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "main",
  "ruleset_rules": [
    {
      "id": 100023,
      "parameters": {},
      "type": "deletion"
    },
    {
      "id": 100024,
      "parameters": {},
      "type": "non_fast_forward"
    },
    {
      "id": 100025,
      "parameters": {
        "allowed_merge_methods": [
          "squash",
          "rebase",
          "merge"
        ],
        "authorized_dismissal_actors_only": false,
        "dismiss_stale_reviews_on_push": false,
        "dismissal_restriction": {
          "allowed_actors": [],
          "enabled": false
        },
        "ignore_approvals_from_contributors": false,
        "require_code_owner_review": true,
        "require_last_push_approval": false,
        "required_approving_review_count": 1,
        "required_review_thread_resolution": false,
        "required_reviewers": []
      },
      "type": "pull_request"
    }
  ],
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "ruleset_conditions": [
    {
      "id": 100026,
      "parameters": {
        "exclude": [],
        "include": [
          "~DEFAULT_BRANCH"
        ]
      },
      "target": "ref_name"
    }
  ],
  "ruleset_enforcement": "disabled",
  "ruleset_source_type": "Repository",
  "ruleset_bypass_actors": [],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

repository_ruleset.destroy

#
Category
repository-ruleset

Description

A repository ruleset was deleted.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000352,
  "actor_id": 9000047,
  "created_at": 1784552870922.0,
  "ruleset_id": 9000353,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.destroy",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000354,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "example-label-146",
  "ruleset_rules": [
    {
      "id": 100005,
      "parameters": {},
      "type": "deletion"
    },
    {
      "id": 100006,
      "parameters": {},
      "type": "non_fast_forward"
    },
    {
      "id": 100007,
      "parameters": {
        "update_allows_fetch_and_merge": false
      },
      "type": "update"
    },
    {
      "id": 100008,
      "parameters": {},
      "type": "creation"
    }
  ],
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "ruleset_conditions": [
    {
      "id": 100009,
      "parameters": {
        "exclude": [],
        "include": [
          "~ALL"
        ]
      },
      "target": "ref_name"
    }
  ],
  "ruleset_enforcement": "enabled",
  "ruleset_source_type": "Repository",
  "ruleset_bypass_actors": [
    {
      "actor_id": 9000355,
      "actor_type": "Team",
      "bypass_mode": "always",
      "id": 100010
    },
    {
      "actor_id": 9000356,
      "actor_type": "Team",
      "bypass_mode": "always",
      "id": 100011
    }
  ],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • GitHub Enterprise Delete Branch Ruleset source: The following analytic detects when branch rules are deleted in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information, and associated…T1195, T1685
  • GitHub Organizations Delete Branch Ruleset source: The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and…T1195, T1685

Panther #

repository_ruleset.update

#
Category
repository-ruleset

Description

A repository ruleset was edited.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000348,
  "actor_id": 9000084,
  "created_at": 1785270369240.0,
  "ruleset_id": 9000350,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.update",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000357,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "main",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "ruleset_enforcement": "enabled",
  "ruleset_source_type": "Repository",
  "ruleset_old_enforcement": "disabled",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

References #