Detection rules › Panther
Github Repository Transfer
A user accepted a request to receive a transferred Github repository, a Github repository was transferred to another repository network, or a user sent a request to transfer a repository to another user or organization.
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body yaml
AnalysisType: rule
Description: A user accepted a request to receive a transferred Github repository, a Github repository was transferred to another repository network, or a user sent a request to transfer a repository to another user or organization.
DisplayName: "Github Repository Transfer"
Enabled: true
Filename: github_repository_transfer.py
Reference: |-
https://docs.github.com/en/enterprise-server@3.3/repositories/creating-and-managing-repositories/transferring-a-repository
https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#repo-category-actions
Runbook: Please check with the referenced users or their supervisors to ensure the transferring of this repository is expected and allowed.
Severity: Medium
Tags:
- Github Repository
- Github Repository Transfer
- Repository
- Transfer
Tests:
- ExpectedResult: false
Log:
_document_id: abCD
action: repo.create
actor: example-actor
actor_location:
country_code: US
at_sign_timestamp: "2022-12-11 22:40:20.268"
created_at: "2022-12-11 22:40:20.268"
org: example-io
repo: example-io/oops
visibility: public
Name: Public Repo Created
- ExpectedResult: true
Log:
_document_id: BodJtQIrT3kWMIQpm1ANew
action: repo.transfer_outgoing
actor: user-name
actor_location:
country_code: US
at_sign_timestamp: "2022-12-14 19:16:31.299"
created_at: "2022-12-14 19:16:31.299"
org: your-organization
repo: your-organizatoin/project_repo
visibility: private
Name: Repo Transfer Outgoing
- ExpectedResult: true
Log:
_document_id: BodJtQIrT3kWMIQpm1ANew
action: repo.transfer_start
actor: user-name
actor_location:
country_code: US
at_sign_timestamp: "2022-12-14 19:16:31.299"
created_at: "2022-12-14 19:16:31.299"
org: your-organization
repo: your-organizatoin/project_repo
visibility: private
Name: Repo Transfer Start
- ExpectedResult: true
Log:
_document_id: CFyS8UJsQjJfCgsmTLI6mQ
action: repo.transfer
actor: org-user
actor_location:
country_code: US
at_sign_timestamp: "2022-12-14 19:21:01.035"
created_at: "2022-12-14 19:21:01.035"
org: your-organization
repo: your-organization/project_repo
visibility: private
Name: Repository Transfer
DedupPeriodMinutes: 60
LogTypes:
- GitHub.Audit
RuleID: "Github.Repository.Transfer"
SummaryAttributes:
- action
Threshold: 1
Detection logic
Condition
action in ["repo.transfer", "repo.transfer_outgoing", "repo.transfer_start"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
action | |
actor | |
actor_location | actor_location.country_code |
org | |
repo | |
user |