Repository Vulnerability Alert

action	Description	Sample	Rule
repository_vulnerability_alert.assign	A user was assigned to a Dependabot alert.	Y	N
repository_vulnerability_alert.auto_dismiss	A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.	Y	N
repository_vulnerability_alert.auto_reopen	A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.	Y	N
repository_vulnerability_alert.create	GitHub created a Dependabot alert because the repository uses a vulnerable dependency.	Y	N
repository_vulnerability_alert.dismiss	A Dependabot alert was manually dismissed.	Y	Y
repository_vulnerability_alert.reintroduce	A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.	Y	N
repository_vulnerability_alert.reopen	A Dependabot alert was manually reopened.	N	N
repository_vulnerability_alert.resolve	Changes were pushed to update and resolve a Dependabot alert in a project dependency.	Y	N
repository_vulnerability_alert.unassign	A user was unassigned to a Dependabot alert.	N	N
repository_vulnerability_alert.withdraw	A Dependabot alert was withdrawn.	Y	N

repository_vulnerability_alert.assign

Category: repository-vulnerability-alert

Description

A user was assigned to a Dependabot alert.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000002,
  "repo_id": 9000371,
  "actor_id": 9000372,
  "alert_id": 9000373,
  "created_at": 1782487969303.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "alert_number": 157.0,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "owner": "example-org-1",
  "action": "repository_vulnerability_alert.assign",
  "ghsa_id": 9000374,
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000375,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

Humpty from IRCC

repository_vulnerability_alert.auto_dismiss

Category: repository-vulnerability-alert

Description

A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000092,
  "repo_id": 9000376,
  "alert_id": 9000377,
  "created_at": 1785240717889.0,
  "business_id": 9000005,
  "public_repo": false,
  "alert_number": 319.0,
  "vulnerability_alert_rule_id": 9000378,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-org-8",
  "action": "repository_vulnerability_alert.auto_dismiss",
  "ghsa_id": 9000379,
  "business": "example-business",
  "operation_type": "modify",
  "vulnerability_alert_rule_name": "Dismiss low-impact alerts for development-scoped dependencies"
}

References #

Humpty from IRCC

repository_vulnerability_alert.auto_reopen

Category: repository-vulnerability-alert

Description

A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000008,
  "repo_id": 9000380,
  "alert_id": 9000381,
  "created_at": 1785241097851.0,
  "business_id": 9000005,
  "public_repo": false,
  "alert_number": 115.0,
  "vulnerability_alert_rule_id": 9000378,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-business-1",
  "action": "repository_vulnerability_alert.auto_reopen",
  "ghsa_id": 9000379,
  "business": "example-business",
  "operation_type": "modify",
  "vulnerability_alert_rule_name": "Dismiss low-impact alerts for development-scoped dependencies"
}

References #

Humpty from IRCC

repository_vulnerability_alert.create

Category: repository-vulnerability-alert

Description

GitHub created a Dependabot alert because the repository uses a vulnerable dependency.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000092,
  "repo_id": 9000382,
  "alert_id": 9000383,
  "created_at": 1785236057174.0,
  "business_id": 9000005,
  "public_repo": false,
  "alert_number": 145.0,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-org-8",
  "action": "repository_vulnerability_alert.create",
  "ghsa_id": 9000384,
  "business": "example-business",
  "operation_type": "create"
}

References #

Humpty from IRCC

repository_vulnerability_alert.dismiss

Category: repository-vulnerability-alert

Description

A Dependabot alert was manually dismissed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000002,
  "repo_id": 9000371,
  "user_id": 9000372,
  "actor_id": 9000372,
  "alert_id": 9000385,
  "token_id": 9000386,
  "created_at": 1782498478285.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "alert_number": 147.0,
  "oauth_application_id": 9000044,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "owner": "example-org-1",
  "action": "repository_vulnerability_alert.dismiss",
  "ghsa_id": 9000387,
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000388,
  "user_agent": "GitHub CLI 2.95.0",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAyNg==",
  "token_scopes": "gist,read:org,repo",
  "actor_location": {
    "country_code": "XX"
  },
  "dismiss_reason": "A fix has already been started",
  "operation_type": "modify",
  "dismiss_comment": "Already resolved — current version on main exceeds the patched version.",
  "external_identity_nameid": "user",
  "programmatic_access_type": "OAuth access token",
  "external_identity_username": "user"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GitHub Dependabot Vulnerability Dismissed source high: Creates an alert if a dependabot alert is dismissed without being fixed.

References #

Humpty from IRCC

repository_vulnerability_alert.reintroduce

Category: repository-vulnerability-alert

Description

A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000008,
  "repo_id": 9000009,
  "alert_id": 9000389,
  "created_at": 1785269868247.0,
  "business_id": 9000005,
  "public_repo": true,
  "alert_number": 894.0,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-business-1",
  "action": "repository_vulnerability_alert.reintroduce",
  "ghsa_id": 9000390,
  "business": "example-business",
  "operation_type": "modify"
}

References #

Humpty from IRCC

repository_vulnerability_alert.reopen

Category: repository-vulnerability-alert

Description

A Dependabot alert was manually reopened.

Documented on GitHub's enterprise audit log reference.

repository_vulnerability_alert.resolve

Category: repository-vulnerability-alert

Description

Changes were pushed to update and resolve a Dependabot alert in a project dependency.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": true,
  "org_id": 9000002,
  "repo_id": 9000391,
  "alert_id": 9000392,
  "created_at": 1785240694684.0,
  "business_id": 9000005,
  "public_repo": false,
  "alert_number": 236.0,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-org-1",
  "action": "repository_vulnerability_alert.resolve",
  "ghsa_id": 9000393,
  "business": "example-business",
  "operation_type": "modify"
}

References #

Humpty from IRCC

repository_vulnerability_alert.unassign

Category: repository-vulnerability-alert

Description

A user was unassigned to a Dependabot alert.

Documented on GitHub's enterprise audit log reference.

repository_vulnerability_alert.withdraw

Category: repository-vulnerability-alert

Description

A Dependabot alert was withdrawn.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "active": false,
  "org_id": 9000092,
  "repo_id": 9000394,
  "alert_id": 9000395,
  "created_at": 1783315717814.0,
  "business_id": 9000005,
  "public_repo": false,
  "alert_number": 272.0,
  "repository_id": 9000394,
  "org": "example-org",
  "repo": "user/example-repo",
  "owner": "example-org-8",
  "action": "repository_vulnerability_alert.withdraw",
  "ghsa_id": 9000396,
  "business": "example-business",
  "operation_type": "modify"
}

References #

Humpty from IRCC