Repository Secret Scanning Generic Secrets
| action | Description | Sample | Rule |
|---|---|---|---|
| repository_ | Generic secrets have been disabled at the repository level | N | Y |
| repository_ | Generic secrets have been enabled at the repository level | Y | N |
repository_secret_scanning_generic_secrets.disabled
#Description
Generic secrets have been disabled at the repository level
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
YARA-L #
T1562
repository_secret_scanning_generic_secrets.enabled
#Description
Generic secrets have been enabled at the repository level
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000157,
"repo_id": 9000358,
"actor_id": 9000359,
"created_at": 1783461844882.0,
"business_id": 9000005,
"public_repo": true,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"topic": "example-label-116",
"action": "repository_secret_scanning_generic_secrets.enabled",
"business": "example-business",
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
References #