Detection rules › By event

GitHub-repo

Event	Rules
repo.access	4
repo.add_member	1
repo.advanced_security_disabled	2
repo.archived	5
repo.create	5
repo.create_actions_secret	1
repo.destroy	6
repo.download_zip	2
repo.pages_public	1
repo.register_self_hosted_runner	2
repo.remove_member	1
repo.remove_self_hosted_runner	1
repo.transfer	1
repo.transfer_outgoing	3
repo.transfer_start	1
repo.unarchived	1

repo.access

4 detection rules reference this event. View event page.

Elastic (1)

GitHub Private Repository Turned Public severity low T1020, T1567, T1567.001

YARA-L (1)

GitHub Repository Visibility Changed To Public severity high

Panther (2)

GitHub Repository Visibility Change severity high T1567
NX Supply Chain - S1ngularity Repository Detection

repo.add_member

1 detection rules reference this event. View event page.

Panther (1)

GitHub Repository Collaborator Change severity medium T1195

repo.advanced_security_disabled

2 detection rules reference this event. View event page.

Sigma (1)

Github High Risk Configuration Disabled severity high T1556

Panther (1)

GitHub Security Change, includes GitHub Advanced Security severity low T1685

repo.archived

5 detection rules reference this event. View event page.

Sigma (1)

GitHub Repository Archive Status Changed severity low

Splunk (2)

GitHub Enterprise Repository Archived severity low T1195, T1485
GitHub Organizations Repository Archived severity low T1195, T1485

YARA-L (1)

GitHub Repository Archived Or Deleted severity low T1485

Panther (1)

GitHub Repository Archived severity informational

repo.create

5 detection rules reference this event. View event page.

Elastic (1)

GitHub Repo Created severity low building block T1583, T1583.006, T1648

Kusto (1)

GitHub - Repository was created severity medium T1078

Panther (3)

Github Public Repository Created severity medium
GitHub Repository Created severity informational
NX Supply Chain - S1ngularity Repository Detection

repo.create_actions_secret

1 detection rules reference this event. View event page.

Sigma (1)

Github New Secret Created severity low T1078, T1078.004

repo.destroy

6 detection rules reference this event. View event page.

Sigma (1)

Github Delete Action Invoked severity medium T1213, T1213.003

Elastic (1)

GitHub Repository Deleted severity medium T1485

Splunk (2)

GitHub Enterprise Repository Deleted severity low T1195, T1485
GitHub Organizations Repository Deleted severity low T1195, T1485

Kusto (1)

GitHub - Repository was destroyed severity medium T1078

YARA-L (1)

GitHub Repository Archived Or Deleted severity low T1485

repo.download_zip

2 detection rules reference this event. View event page.

YARA-L (1)

GitHub High Number Of Non Public GitHub Repositories Downloaded severity high T1213, T1213.003

Panther (1)

NX Supply Chain - S1ngularity Repository Detection

repo.pages_public

1 detection rules reference this event. View event page.

Sigma (1)

GitHub Repository Pages Site Changed to Public severity low T1567, T1567.001

repo.register_self_hosted_runner

2 detection rules reference this event. View event page.

Sigma (1)

Github Self Hosted Runner Changes Detected severity low T1078, T1078.004, T1213, T1213.003, T1526

Elastic (1)

New GitHub Self Hosted Action Runner severity medium T1195, T1195.001, T1195.002

repo.remove_member

1 detection rules reference this event. View event page.

Panther (1)

GitHub Repository Collaborator Change severity medium T1195

repo.remove_self_hosted_runner

1 detection rules reference this event. View event page.

Sigma (1)

Github Self Hosted Runner Changes Detected severity low T1078, T1078.004, T1213, T1213.003, T1526

repo.transfer

1 detection rules reference this event. View event page.

Panther (1)

Github Repository Transfer severity medium

repo.transfer_outgoing

3 detection rules reference this event. View event page.

Sigma (1)

Github Repository/Organization Transferred severity medium T1020, T1537

YARA-L (1)

GitHub Outgoing Repository Transfer Initiated severity high

Panther (1)

Github Repository Transfer severity medium

repo.transfer_start

1 detection rules reference this event. View event page.

Panther (1)

Github Repository Transfer severity medium

repo.unarchived

1 detection rules reference this event. View event page.

Sigma (1)

GitHub Repository Archive Status Changed severity low