Private Repository Forking
| action | Description | Sample | Rule |
|---|---|---|---|
| private_ | An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. | Y | Y |
| private_ | An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked. | Y | N |
| private_ | An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked. | Y | Y |
private_repository_forking.clear
#Description
An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Example Audit Log Entry #
{
"@timestamp": 1783955169330,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMjU=",
"action": "private_repository_forking.clear",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955169330,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE09A6E:F2C6E08:6A54FEE1",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
Detection Rules #
Sigma #
T1020, T1537↳ also matches private_repository_forking.enable
private_repository_forking.disable
#Description
An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783909277248,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDI=",
"action": "private_repository_forking.disable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783909277248,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9EB02F:ADB2541:6A544B9D",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
private_repository_forking.enable
#Description
An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Example Audit Log Entry #
{
"@timestamp": 1783909276895,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMDM=",
"action": "private_repository_forking.enable",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783909276895,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"policy": "enterprise_organizations",
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "9788:205095:A9EAE7E:ADB23AB:6A544B9C",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user": "user",
"user_agent": "python-requests/2.34.2",
"user_id": 9000002
}
Detection Rules #
Sigma #
T1020, T1537↳ also matches private_repository_forking.clear