Dependabot Security Updates New Repos
| action | Description | Sample | Rule |
|---|---|---|---|
| dependabot_ | Dependabot security updates were disabled for all new repositories. | Y | Y |
| dependabot_ | Dependabot security updates were enabled for all new repositories. | Y | N |
dependabot_security_updates_new_repos.disable
#Description
Dependabot security updates were disabled for all new repositories.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action2 detection rules Panther, Sigma Example Audit Log Entry #
{
"@timestamp": 1783957529609,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNTU=",
"action": "dependabot_security_updates_new_repos.disable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783957529609,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "EA04:7E563:F4C158D:F98DAA5:6A550819",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
Detection Rules #
Sigma #
T1195, T1195.001YARA-L #
T1562Panther #
T1562
dependabot_security_updates_new_repos.enable
#Description
Dependabot security updates were enabled for all new repositories.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783957525840,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNjU=",
"action": "dependabot_security_updates_new_repos.enable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783957525840,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "EA04:7E563:F4BFE5A:F98C321:6A550815",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}