Detection rules › By catalog entry

GitHub-audit-log-streaming

Catalog entry	Rules
audit_log_streaming.destroy	2
audit_log_streaming.update	3

audit_log_streaming.destroy

2 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

GitHub Enterprise Disable Audit Log Event Stream severity low T1195,T1685,T1685.002

YARA-L (1)

GitHub Enterprise Audit Log Stream Destroyed severity high T1685,T1685.002

audit_log_streaming.update

3 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

GitHub Enterprise Modify Audit Log Event Stream severity low T1195,T1685,T1685.002
GitHub Enterprise Pause Audit Log Event Stream severity low T1195,T1685,T1685.002

YARA-L (1)

GitHub Enterprise Audit Log Stream Modified severity high T1685,T1685.002

Back to all GitHub-audit-log-streaming catalog entries