IP Allow List Entry
| action | Description | Sample | Rule |
|---|---|---|---|
| ip_ | An IP address was added to an IP allow list. | Y | Y |
| ip_ | An IP address was deleted from an IP allow list. | Y | Y |
| ip_ | An IP address or its description was changed. | Y | Y |
ip_allow_list_entry.create
#Description
An IP address was added to an IP allow list.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"@timestamp": 1783955170382,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjc=",
"action": "ip_allow_list_entry.create",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170382,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "create",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A048:F2C73E5:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.destroy, ip_allow_list_entry.update
ip_allow_list_entry.destroy
#Description
An IP address was deleted from an IP allow list.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"@timestamp": 1783955170926,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjU=",
"action": "ip_allow_list_entry.destroy",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170926,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "remove",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A3C0:F2C7753:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.create, ip_allow_list_entry.update
ip_allow_list_entry.update
#Description
An IP address or its description was changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"@timestamp": 1783955170652,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMjY=",
"action": "ip_allow_list_entry.update",
"active": false,
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955170652,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"ip_allow_list_entry": "ip-redacted/24",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0A239:F2C75D9:6A54FEE2",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
Detection Rules #
Panther #
T1098↳ also matches ip_allow_list_entry.create, ip_allow_list_entry.destroy