Secret Scanning Alert
| action | Description | Sample | Rule |
|---|---|---|---|
| secret_ | A user was assigned to a secret scanning alert. | N | N |
| secret_ | GitHub detected a secret and created a secret scanning alert. | Y | Y |
| secret_ | A secret scanning alert was deleted by GitHub. Note that deletions from custom patterns are not logged. | N | N |
| secret_ | A secret scanning alert was leaked in a public repo. | N | N |
| secret_ | A secret scanning alert was reopened. | N | N |
| secret_ | A leaked secret was reported to the secret's provider by secret scanning. | N | N |
| secret_ | A secret scanning alert was resolved. | N | N |
| secret_ | A secret scanning alert was revoked. | N | N |
| secret_ | A user was unassigned from a secret scanning alert. | N | N |
| secret_ | A secret scanning alert was validated. | N | N |
| secret_ | Y | N |
secret_scanning_alert.assign
#Description
A user was assigned to a secret scanning alert.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.create
#Description
GitHub detected a secret and created a secret scanning alert.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"number": 1.0,
"org_id": 9000169,
"repo_id": 9000403,
"actor_id": 9000404,
"created_at": 1784227392053.0,
"multi_repo": true,
"business_id": 9000005,
"publicly_leaked": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"action": "secret_scanning_alert.create",
"business": "example-business",
"secret_type": "generic_private_key",
"secret_type_display_name": "Generic Private Key"
}
Detection Rules #
YARA-L #
T1552Panther #
T1552References #
secret_scanning_alert.delete
#Description
A secret scanning alert was deleted by GitHub. Note that deletions from custom patterns are not logged.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.public_leak
#Description
A secret scanning alert was leaked in a public repo.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.reopen
#Description
A secret scanning alert was reopened.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.report
#Description
A leaked secret was reported to the secret's provider by secret scanning.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.resolve
#Description
A secret scanning alert was resolved.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.revoke
#Description
A secret scanning alert was revoked.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.unassign
#Description
A user was unassigned from a secret scanning alert.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.validate
#Description
A secret scanning alert was validated.
Documented on GitHub's enterprise audit log reference.
secret_scanning_alert.metadata_create
#Example Audit Log Entry #
{
"number": 72.0,
"org_id": 9000008,
"repo_id": 9000405,
"actor_id": 9000404,
"created_at": 1783412212075.0,
"multi_repo": false,
"business_id": 9000005,
"publicly_leaked": false,
"org": "example-org",
"repo": "user/example-repo",
"actor": "user",
"action": "secret_scanning_alert.metadata_create",
"business": "example-business",
"secret_type": "GITHUB_PERSONAL_ACCESS_TOKEN",
"secret_type_display_name": "GitHub Personal Access Token"
}