OAuth Application
| action | Description | Sample | Rule |
|---|---|---|---|
| oauth_ | An OAuth application was created. | N | N |
| oauth_ | An OAuth application was deleted. | N | N |
| oauth_ | An OAuth application's secret key was generated. | N | N |
| oauth_ | An OAuth application's secret key was deleted. | N | Y |
| oauth_ | The secret key for an OAuth application was reset. | N | N |
| oauth_ | All user tokens for an OAuth application were requested to be revoked. | N | N |
| oauth_ | Token(s) for an OAuth application were revoked. | N | N |
| oauth_ | An OAuth application was transferred from one account to another. | N | N |
oauth_application.create
#Description
An OAuth application was created.
Documented on GitHub's enterprise audit log reference.
oauth_application.destroy
#Description
An OAuth application was deleted.
Documented on GitHub's enterprise audit log reference.
oauth_application.generate_client_secret
#Description
An OAuth application's secret key was generated.
Documented on GitHub's enterprise audit log reference.
oauth_application.remove_client_secret
#Description
An OAuth application's secret key was deleted.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Kusto Detection Rules #
Kusto #
T1078
oauth_application.reset_secret
#Description
The secret key for an OAuth application was reset.
Documented on GitHub's enterprise audit log reference.
oauth_application.revoke_all_tokens
#Description
All user tokens for an OAuth application were requested to be revoked.
Documented on GitHub's enterprise audit log reference.
oauth_application.revoke_tokens
#Description
Token(s) for an OAuth application were revoked.
Documented on GitHub's enterprise audit log reference.
oauth_application.transfer
#Description
An OAuth application was transferred from one account to another.
Documented on GitHub's enterprise audit log reference.