Detection rules › By event

GitHub-audit-log-streaming

Event	Rules
audit_log_streaming.destroy	2
audit_log_streaming.update	3

audit_log_streaming.destroy

2 detection rules reference this event. View event page.

Splunk (1)

GitHub Enterprise Disable Audit Log Event Stream severity low T1195, T1685, T1685.002

YARA-L (1)

GitHub Enterprise Audit Log Stream Destroyed severity high T1685, T1685.002

audit_log_streaming.update

3 detection rules reference this event. View event page.

Splunk (2)

GitHub Enterprise Modify Audit Log Event Stream severity low T1195, T1685, T1685.002
GitHub Enterprise Pause Audit Log Event Stream severity low T1195, T1685, T1685.002

YARA-L (1)

GitHub Enterprise Audit Log Stream Modified severity high T1685, T1685.002