detection.wiki

Detection rules › Panther

Github Organization App Integration Installed

Severity
low
Entities
usernames
Log types
GitHub.Audit
Tags
Application Installation, Github
Reference
https://docs.github.com/en/enterprise-server@3.4/developers/apps/managing-github-apps/installing-github-apps
Source
github.com/panther-labs/panther-analysis

An application integration was installed to your organization's Github account by someone in your organization.

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: rule
Description: An application integration was installed to your organization's Github account by someone in your organization.
DisplayName: "Github Organization App Integration Installed"
Enabled: true
Filename: github_organization_app_integration_installed.py
Reference: https://docs.github.com/en/enterprise-server@3.4/developers/apps/managing-github-apps/installing-github-apps
Runbook: Confirm that the app integration installation was a desired behavior.
Severity: Low
Tags:
  - Application Installation
  - Github
Tests:
  - ExpectedResult: true
    Log:
      _document_id: A-2345
      action: integration_installation.create
      actor: user_name
      actor_location:
        country_code: US
      at_sign_timestamp: "2022-12-11 05:28:05.542"
      created_at: "2022-12-11 05:28:05.542"
      name: Microsoft Teams for GitHub
      org: your-organization
      p_any_usernames:
        - user_name
    Name: App Integration Installation
  - ExpectedResult: true
    Log:
      _document_id: A-1234
      action: integration_installation.create
      actor: leetboy
      actor_location:
        country_code: US
      at_sign_timestamp: "2022-12-02 17:40:08.671"
      created_at: "2022-12-02 17:40:08.671"
      name: Datadog CI
      org: example-io
    Name: App Integration Installation-2
  - ExpectedResult: false
    Log:
      action: repo.archived
      actor: cat
      created_at: 1.621305118553e+12
      org: my-org
      p_log_type: GitHub.Audit
      repo: my-org/my-repo
    Name: Repository Archived
DedupPeriodMinutes: 60
LogTypes:
  - GitHub.Audit
RuleID: "Github.Organization.App.Integration.Installed"
SummaryAttributes:
  - actor
  - name
Threshold: 1

Detection logic

Condition

action eq "integration_installation.create"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actioneq
  • integration_installation.create

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
action
actor
actor_locationactor_location.country_code
org
repo
user
name