Business Advanced Security
| action | Description | Sample | Rule |
|---|---|---|---|
| business_ | GitHub Advanced Security was disabled for your enterprise. | N | Y |
| business_ | GitHub Advanced Security was disabled for new repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was disabled for new user namespace repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was enabled for your enterprise. | N | N |
| business_ | GitHub Advanced Security was enabled for new repositories in your enterprise. | N | N |
| business_ | GitHub Advanced Security was enabled for new user namespace repositories in your enterprise. | N | N |
| business_ | GitHub Advanced Security was disabled for user namespace repositories in your enterprise. | N | Y |
| business_ | GitHub Advanced Security was enabled for user namespace repositories in your enterprise. | N | N |
business_advanced_security.disabled
#Description
GitHub Advanced Security was disabled for your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action2 detection rules Panther, Sigma Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled_for_new_repos, business_advanced_security.disabled_for_new_user_namespace_repos, business_advanced_security.user_namespace_repos_disabled Panther #
T1562↳ also matches business_advanced_security.disabled_for_new_repos
business_advanced_security.disabled_for_new_repos
#Description
GitHub Advanced Security was disabled for new repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action2 detection rules Panther, Sigma Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_user_namespace_repos, business_advanced_security.user_namespace_repos_disabled Panther #
T1562↳ also matches business_advanced_security.disabled
business_advanced_security.disabled_for_new_user_namespace_repos
#Description
GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_repos, business_advanced_security.user_namespace_repos_disabled
business_advanced_security.enabled
#Description
GitHub Advanced Security was enabled for your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.enabled_for_new_repos
#Description
GitHub Advanced Security was enabled for new repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.enabled_for_new_user_namespace_repos
#Description
GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
business_advanced_security.user_namespace_repos_disabled
#Description
GitHub Advanced Security was disabled for user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Detection Rules #
Sigma #
T1556↳ also matches business_advanced_security.disabled, business_advanced_security.disabled_for_new_repos, business_advanced_security.disabled_for_new_user_namespace_repos
business_advanced_security.user_namespace_repos_enabled
#Description
GitHub Advanced Security was enabled for user namespace repositories in your enterprise.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.