GitHub - pull request was merged

Status: available
Severity: medium
Time window: 7d
Source: github.com/Azure/Azure-Sentinel

Detect activities when a pull request was merged. This query runs every day and its severity is Medium.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `pull_request.merge`: Pull request merged

Rule body

id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c6
name: GitHub - pull request was merged
description: |
  'Detect activities when a pull request was merged. This query runs every day and its severity is Medium.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
    GitHubAuditData
    | where Action == "pull_request.merge"
    | project Actor, Action
    | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "pull_request.merge"

Stage 3: `project`

| project Actor, Action

Stage 4: `extend`

| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`pull_request.merge`	`field:"Action" kind:eq value:"pull_request.merge"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`Actor`	`project`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`