Detection rules › By event

GitHub-org

Event	Rules
org.accept_business_invitation	1
org.add_billing_manager	1
org.add_disallowed_two_factor_method	1
org.add_member	6
org.add_outside_collaborator	1
org.add_security_manager	1
org.advanced_security_disabled_for_new_repos	3
org.advanced_security_disabled_on_all_repos	3
org.advanced_security_enabled_for_new_repos	1
org.advanced_security_enabled_on_all_repos	1
org.advanced_security_entity_policy_update	1
org.advanced_security_policy_selected_member_disabled	3
org.advanced_security_policy_selected_member_enabled	1
org.allow_third_party_access_requests_from_outside_collaborators_disabled	1
org.allow_third_party_access_requests_from_outside_collaborators_enabled	1
org.archive	1
org.audit_log_export	1
org.audit_log_git_event_export	1
org.billing_signup_error	1
org.block_user	4
org.cancel_business_invitation	1
org.cancel_invitation	1
org.clear_custom_invitation_rate_limit	1
org.clear_disallowed_two_factor_methods	1
org.code_quality_entity_policy_update	1
org.code_scanning_ai_findings_disabled	1
org.code_scanning_ai_findings_enabled	1
org.code_scanning_autofix_disabled	1
org.code_scanning_autofix_enabled	1
org.code_scanning_autofix_third_party_tools_disabled	1
org.code_scanning_autofix_third_party_tools_enabled	1
org.code_scanning_scan_inactive_repos_disabled	1
org.code_scanning_scan_inactive_repos_enabled	1
org.code_security_metered_usage_lock	1
org.code_security_metered_usage_unlock	1
org.codeql_disabled	1
org.codeql_enabled	1
org.codespaces_access_updated	1
org.codespaces_ownership_updated	1
org.codespaces_team_access_allowed	1
org.codespaces_team_access_revoked	1
org.codespaces_trusted_repo_access_granted	1
org.codespaces_trusted_repo_access_revoked	1
org.codespaces_user_access_allowed	1
org.codespaces_user_access_revoked	1
org.config.disable_collaborators_only	1
org.config.disable_contributors_only	1
org.config.disable_sockpuppet_disallowed	1
org.config.enable_collaborators_only	1
org.config.enable_contributors_only	1
org.config.enable_sockpuppet_disallowed	1
org.configure_self_hosted_jit_runner	1
org.confirm_business_invitation	1
org.connect_usage_metrics_export	1
org.create	1
org.create_actions_secret	2
org.create_actions_variable	1
org.create_integration_secret	1
org.delete	1
org.delete_custom_image	1
org.delete_custom_image_version	1
org.disable_member_team_creation_permission	1
org.disable_oauth_app_restrictions	3
org.disable_reader_discussion_creation_permission	1
org.disable_saml	2
org.disable_source_ip_disclosure	1
org.disable_two_factor_requirement	7
org.display_commenter_full_name_disabled	1
org.display_commenter_full_name_enabled	1
org.enable_member_team_creation_permission	1
org.enable_oauth_app_restrictions	1
org.enable_reader_discussion_creation_permission	1
org.enable_saml	1
org.enable_source_ip_disclosure	1
org.enable_two_factor_requirement	1
org.integration_manager_added	1
org.integration_manager_removed	1
org.invite_member	4
org.invite_to_business	1
org.members_can_update_protected_branches.disable	1
org.members_can_update_protected_branches.enable	1
org.members_limit_warning	1
org.oauth_app_access_approved	1
org.oauth_app_access_blocked	1
org.oauth_app_access_denied	1
org.oauth_app_access_requested	1
org.oauth_app_access_unblocked	1
org.rate_limited_invites	1
org.recovery_code_failed	1
org.recovery_code_used	1
org.recovery_codes_downloaded	2
org.recovery_codes_generated	2
org.recovery_codes_printed	2
org.recovery_codes_viewed	2
org.register_self_hosted_runner	2
org.remove_actions_secret	1
org.remove_actions_variable	1
org.remove_billing_manager	1
org.remove_disallowed_two_factor_method	1
org.remove_integration_secret	1
org.remove_member	3
org.remove_outside_collaborator	2
org.remove_security_manager	1
org.remove_self_hosted_runner	2
org.rename	1
org.required_workflow_create	1
org.required_workflow_delete	1
org.required_workflow_update	1
org.restore_member	1
org.revoke_external_identity	1
org.revoke_sso_session	1
org.runner_group_created	2
org.runner_group_removed	2
org.runner_group_renamed	1
org.runner_group_runner_removed	2
org.runner_group_runners_added	2
org.runner_group_runners_updated	2
org.runner_group_updated	2
org.runner_group_visiblity_updated	1
org.secret_protection_metered_usage_lock	1
org.secret_protection_metered_usage_unlock	1
org.secret_scanning_custom_pattern_push_protection_disabled	2
org.secret_scanning_custom_pattern_push_protection_enabled	1
org.secret_scanning_push_protection_custom_message_disabled	1
org.secret_scanning_push_protection_custom_message_enabled	1
org.secret_scanning_push_protection_custom_message_updated	1
org.secret_scanning_push_protection_disable	2
org.secret_scanning_push_protection_enable	1
org.secret_scanning_push_protection_new_repos_disable	2
org.secret_scanning_push_protection_new_repos_enable	1
org.security_center_export_code_scanning_metrics	1
org.security_center_export_coverage	1
org.security_center_export_overview_dashboard	1
org.security_center_export_risk	1
org.self_hosted_runner_offline	1
org.self_hosted_runner_online	1
org.self_hosted_runner_updated	1
org.set_actions_cache_retention_policy	1
org.set_actions_cache_storage_policy	1
org.set_actions_fork_pr_approvals_policy	1
org.set_actions_private_fork_pr_approvals_policy	1
org.set_actions_retention_limit	1
org.set_custom_invitation_rate_limit	1
org.set_default_workflow_permissions	2
org.set_fork_pr_workflows_policy	1
org.set_workflow_permission_can_approve_pr	1
org.sso_response	1
org.transfer	2
org.transfer_outgoing	3
org.unarchive	1
org.unblock_user	2
org.update_actions_secret	1
org.update_actions_settings	1
org.update_actions_variable	1
org.update_custom_images_policy	1
org.update_default_repository_permission	1
org.update_immutable_releases_settings_policy	1
org.update_integration_secret	1
org.update_member	3
org.update_member_repository_creation_permission	1
org.update_member_repository_invitation_permission	1
org.update_new_repository_default_branch_setting	1
org.update_repo_self_hosted_runners_policy	1
org.update_saml_provider_settings	2
org.update_terms_of_service	1