Team
| action | Description | Sample | Rule |
|---|---|---|---|
| team. | A member of an organization was added to a team. | Y | Y |
| team. | A team was given access and permissions to a repository. | Y | Y |
| team. | A team was added to an organization. | N | Y |
| team. | A child team was created or a child team's parent was changed. | Y | Y |
| team. | A team's privacy level was changed. | Y | Y |
| team. | A new team is created. | Y | Y |
| team. | A user was demoted from a team maintainer to a team member. | N | Y |
| team. | A team was deleted. | Y | Y |
| team. | A team is approaching its members limit. | N | Y |
| team. | A team has reached its organization assignments limit. | N | Y |
| team. | A team is approaching its organization assignments limit. | N | Y |
| team. | A user was promoted from a team member to a team maintainer. | Y | Y |
| team. | A team was removed from an organization. | N | Y |
| team. | An organization member was removed from a team. | Y | Y |
| team. | A repository was removed from a team's control. | Y | Y |
| team. | A team's name was changed. | Y | Y |
| team. | A team's permission to a repository was changed. | Y | Y |
team.add_member
#Description
A member of an organization was added to a team.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000407,
"actor_id": 9000155,
"created_at": 1782482832874.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.add_member",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000408,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.add_repository
#Description
A team was given access and permissions to a repository.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"repo_id": 9000348,
"actor_id": 9000084,
"created_at": 1785258901216.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-org-1/example-team-1",
"actor": "user",
"action": "team.add_repository",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"permission": "admin",
"request_id": 9000409,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.add_to_organization
#Description
A team was added to an organization.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more
team.change_parent_team
#Description
A child team was created or a child team's parent was changed.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000060,
"created_at": 1781806971059.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-2",
"actor": "user",
"action": "team.change_parent_team",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000410,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.change_privacy
#Description
A team's privacy level was changed.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000060,
"created_at": 1782139068321.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-13",
"actor": "user",
"action": "team.change_privacy",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000411,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.create, team.demote_maintainer, and 10 more References #
team.create
#Description
A new team is created.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"user_id": 9000060,
"actor_id": 9000060,
"created_at": 1782138960825.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-13",
"user": "user",
"actor": "user",
"action": "team.create",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000412,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.demote_maintainer, and 10 more References #
team.demote_maintainer
#Description
A user was demoted from a team maintainer to a team member.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.destroy
#Description
A team was deleted.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000047,
"created_at": 1781705068568.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-6",
"actor": "user",
"action": "team.destroy",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000413,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.members_limit_warning
#Description
A team is approaching its members limit.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.organization_assignments_limit_reached
#Description
A team has reached its organization assignments limit.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.organization_assignments_limit_warning
#Description
A team is approaching its organization assignments limit.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.promote_maintainer
#Description
A user was promoted from a team member to a team maintainer.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000205,
"actor_id": 9000407,
"token_id": 9000414,
"created_at": 1782483411320.0,
"business_id": 9000005,
"actor_is_bot": false,
"oauth_application_id": 9000044,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.promote_maintainer",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000415,
"user_agent": "GitHub CLI 2.95.0",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAyNw==",
"token_scopes": "copilot,gist,read:org,repo,workflow",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"programmatic_access_type": "OAuth access token",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.remove_from_organization
#Description
A team was removed from an organization.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.remove_member
#Description
An organization member was removed from a team.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000155,
"actor_id": 9000155,
"created_at": 1782482853034.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.remove_member",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000416,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.remove_repository
#Description
A repository was removed from a team's control.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000046,
"actor_id": 9000047,
"created_at": 1784577550990.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-business-1/example-team-14",
"actor": "user",
"action": "team.remove_repository",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000049,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.rename
#Description
A team's name was changed.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000417,
"created_at": 1783518323920.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"name": "example-label-150",
"team": "example-business-1/example-team-9",
"actor": "user",
"action": "team.rename",
"actor_ip": "ip-redacted",
"business": "example-business",
"name_was": "CUI - Service Connectivity",
"team_type": "organization",
"request_id": 9000418,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.update_repository_permission
#Description
A team's permission to a repository was changed.
Documented on GitHub's enterprise audit log reference. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"repo_id": 9000201,
"user_id": 9000419,
"actor_id": 9000419,
"created_at": 1785241188287.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-org-1/example-team-4",
"user": "user",
"actor": "user",
"action": "team.update_repository_permission",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000420,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"old_permissions": {
"admin": false,
"maintain": false,
"pull": true,
"push": true,
"triage": true
},
"old_repo_base_role": "write",
"new_repo_permission": "admin",
"old_repo_permission": "Write + Security Alerts",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #