detection.wiki

Repository Vulnerability Alerts

actionDescriptionSampleRule
repository_vulnerability_alerts.authorized_users_teamsThe list of people or teams authorized to receive Dependabot alerts for the repository was updated.YN
repository_vulnerability_alerts.disableDependabot alerts was disabled.YY
repository_vulnerability_alerts.enableDependabot alerts was enabled.YN

repository_vulnerability_alerts.authorized_users_teams

#
Category
repository-vulnerability-alerts

Description

The list of people or teams authorized to receive Dependabot alerts for the repository was updated.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000368,
  "actor_id": 9000369,
  "created_at": 1781030930041.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_vulnerability_alerts.authorized_users_teams",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000397,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

repository_vulnerability_alerts.disable

#
Category
repository-vulnerability-alerts

Description

Dependabot alerts was disabled.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783910559901,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNzQ=",
  "action": "repository_vulnerability_alerts.disable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783910559901,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000011,
  "request_access_security_header": null,
  "request_id": "94D6:32DEEF:B397812:B76825E:6A54509F",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Splunk #

  • GitHub Enterprise Disable Dependabot source: The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise…T1195, T1685
  • GitHub Organizations Disable Dependabot source: The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise…T1195, T1685

YARA-L #

Panther #

References #

repository_vulnerability_alerts.enable

#
Category
repository-vulnerability-alerts

Description

Dependabot alerts was enabled.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000092,
  "repo_id": 9000276,
  "user_id": 9000093,
  "actor_id": 9000093,
  "created_at": 1783271787344.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "topic": "example-label-116",
  "action": "repository_vulnerability_alerts.enable",
  "business": "example-business",
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #