Team Group Mapping
| action | Description | Sample | Rule |
|---|---|---|---|
| team_ | Y | Y | |
| team_ | Y | Y | |
| team_ | Y | Y |
team_group_mapping.create
#Documented on GitHub's organization audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784737287259.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.create",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000421,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.destroy, team_group_mapping.update
team_group_mapping.destroy
#Documented on GitHub's organization audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784738620872.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.destroy",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000422,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.create, team_group_mapping.update
team_group_mapping.update
#Documented on GitHub's organization audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784738620902.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.update",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000422,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.create, team_group_mapping.destroy