Protected Branch operations

action	Description	Sample	Rule
protected_branch.authorized_users_teams	The users, teams, or integrations allowed to bypass a branch protection were changed.	Y	Y
protected_branch.branch_allowances	A protected branch allowance was given to a specific user, team or integration.	Y	Y
protected_branch.create	Branch protection was enabled on a branch.	Y	Y
protected_branch.destroy	Branch protection was disabled on a branch.	Y	Y
protected_branch.dismiss_stale_reviews	Enforcement of dismissing stale pull requests was updated on a branch.	Y	Y
protected_branch.dismissal_restricted_users_teams	Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.	N	Y
protected_branch.policy_override	A branch protection requirement was overridden by a repository administrator.	Y	Y
protected_branch.rejected_ref_update	A branch update attempt was rejected.	Y	Y
protected_branch.update_admin_enforced	Branch protection was enforced for repository administrators.	Y	Y
protected_branch.update_allow_deletions_enforcement_level	Branch deletion was enabled or disabled for a protected branch.	Y	Y
protected_branch.update_allow_force_pushes_enforcement_level	Force pushes were enabled or disabled for a branch.	Y	Y
protected_branch.update_ignore_approvals_from_contributors	Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.	N	Y
protected_branch.update_linear_history_requirement_enforcement_level	Required linear commit history was enabled or disabled for a branch.	Y	Y
protected_branch.update_lock_allows_fetch_and_merge	Fork syncing was enabled or disabled for a read-only branch	Y	Y
protected_branch.update_lock_branch_enforcement_level	The enforcement of a branch lock was updated.	Y	Y
protected_branch.update_merge_queue_enforcement_level	Enforcement of the merge queue was modified for a branch.	Y	Y
protected_branch.update_name	A branch name pattern was updated for a branch.	N	Y
protected_branch.update_pull_request_reviews_enforcement_level	Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).	Y	Y
protected_branch.update_require_code_owner_review	Enforcement of required code owner review was updated for a branch.	Y	Y
protected_branch.update_require_last_push_approval	Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.	Y	Y
protected_branch.update_required_approving_review_count	Enforcement of the required number of approvals before merging was updated on a branch.	Y	Y
protected_branch.update_required_status_checks_enforcement_level	Enforcement of required status checks was updated for a branch.	Y	Y
protected_branch.update_signature_requirement_enforcement_level	Enforcement of required commit signing was updated for a branch.	Y	Y
protected_branch.update_strict_required_status_checks_policy	Enforcement of required status checks was updated for a branch.	Y	Y

protected_branch.authorized_users_teams

Category: protected-branch

Description

The users, teams, or integrations allowed to bypass a branch protection were changed.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000112,
  "actor_id": 9000113,
  "created_at": 1781288577866.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "master",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.authorized_users_teams",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000178,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, protected_branch.policy_override, and 17 more

References #

Humpty from IRCC

protected_branch.branch_allowances

#

Category: protected-branch

Description

A protected branch allowance was given to a specific user, team or integration.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000179,
  "actor_id": 9000047,
  "created_at": 1783958818057.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "name": "master",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.branch_allowances",
  "policy": "pull_request",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000180,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "authorized_actors": [],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, protected_branch.policy_override, and 17 more

References #

Humpty from IRCC

protected_branch.create

#

Category: protected-branch

Description

Branch protection was enabled on a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000181,
  "user_id": 9000182,
  "actor_id": 9000182,
  "created_at": 1781093003196.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "actor_is_agent": false,
  "admin_enforced": true,
  "create_protected": false,
  "require_code_owner_review": false,
  "require_last_push_approval": false,
  "lock_allows_fetch_and_merge": false,
  "dismiss_stale_reviews_on_push": true,
  "lock_branch_enforcement_level": 0.0,
  "merge_queue_enforcement_level": 0.0,
  "required_approving_review_count": 1.0,
  "allow_deletions_enforcement_level": 0.0,
  "ignore_approvals_from_contributors": false,
  "allow_force_pushes_enforcement_level": 0.0,
  "strict_required_status_checks_policy": true,
  "pull_request_reviews_enforcement_level": 2.0,
  "required_deployments_enforcement_level": 0.0,
  "signature_requirement_enforcement_level": 0.0,
  "required_status_checks_enforcement_level": 0.0,
  "linear_history_requirement_enforcement_level": 0.0,
  "required_review_thread_resolution_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "user": "user",
  "actor": "user",
  "action": "protected_branch.create",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000183,
  "user_agent": "example.invalid/7.0.6 example.invalid/24",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNQ==",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "enforcement_level": "off",
  "authorized_actor_names": [],
  "programmatic_access_type": "GitHub App server-to-server token"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, protected_branch.policy_override, and 17 more

References #

Humpty from IRCC

protected_branch.destroy

#

Category: protected-branch

Description

Branch protection was disabled on a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`action`	2 detection rules	Panther, Splunk
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic
`vendor_action`	1 detection rule	Splunk

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000184,
  "actor_id": 9000185,
  "created_at": 1782838978611.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "admin_enforced": false,
  "create_protected": false,
  "require_code_owner_review": true,
  "require_last_push_approval": false,
  "lock_allows_fetch_and_merge": false,
  "dismiss_stale_reviews_on_push": false,
  "lock_branch_enforcement_level": 0.0,
  "merge_queue_enforcement_level": 0.0,
  "required_approving_review_count": 1.0,
  "allow_deletions_enforcement_level": 0.0,
  "ignore_approvals_from_contributors": false,
  "allow_force_pushes_enforcement_level": 2.0,
  "strict_required_status_checks_policy": true,
  "pull_request_reviews_enforcement_level": 1.0,
  "required_deployments_enforcement_level": 0.0,
  "signature_requirement_enforcement_level": 0.0,
  "required_status_checks_enforcement_level": 1.0,
  "linear_history_requirement_enforcement_level": 0.0,
  "required_review_thread_resolution_enforcement_level": 0.0,
  "org": "example-org",
  "name": "example-label-144",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.destroy",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000186,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "enforcement_level": "off",
  "authorized_actor_names": [],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, protected_branch.policy_override, and 17 more

Splunk #

GitHub Enterprise Disable Classic Branch Protection Rule source: The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch protection removal events by tracking actor details, repository…T1195, T1685
GitHub Organizations Disable Classic Branch Protection Rule source: The following analytic detects when classic branch protection rules are disabled in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch protection removal events by tracking actor details, repository…T1195, T1685

Panther #

GitHub Branch Protection Disabled source high: Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.T1195

References #

Humpty from IRCC

protected_branch.dismiss_stale_reviews

#

Category: protected-branch

Description

Enforcement of dismissing stale pull requests was updated on a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000187,
  "actor_id": 9000188,
  "created_at": 1784569634413.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "dismiss_stale_reviews_on_push": false,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.dismiss_stale_reviews",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000189,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismissal_restricted_users_teams, protected_branch.policy_override, and 17 more

References #

Humpty from IRCC

protected_branch.dismissal_restricted_users_teams

#

Category: protected-branch

Description

Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.policy_override, and 17 more

protected_branch.policy_override

#

Category: protected-branch

Description

A branch protection requirement was overridden by a repository administrator.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	2 detection rules	Elastic
`github.category`	2 detection rules	Elastic
`action`	1 detection rule	Panther
`event.action`	1 detection rule	Elastic
`github.reasons.code`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000190,
  "actor_id": 9000191,
  "created_at": 1785236416581.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "rule_suite_id": 9000192,
  "actor_is_agent": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "after": "gggggggggggggggggggggggggggggggggggggggg",
  "action": "protected_branch.policy_override",
  "before": "gggggggggggggggggggggggggggggggggggggggg",
  "branch": "example-branch-15",
  "reasons": [
    {
      "code": "creation",
      "message": "Cannot create ref due to creations being restricted."
    }
  ],
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000193,
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "overridden_codes": []
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	2 rules	elastic
`Esql.event_count` (elastic rule field)	ge	`10`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

High Number of Protected Branch Force Pushes by User source medium: Detects a high number of force push actions to protected branches by a single user within a short time frame. Adversaries may perform force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.T1020, T1485, T1565, T1565.001, T1567, T1567.001
GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

Panther #

GitHub Branch Protection Policy Override source high: Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.T1195

References #

Humpty from IRCC

protected_branch.rejected_ref_update

#

Category: protected-branch

Description

A branch update attempt was rejected.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`github.category`	3 detection rules	Elastic
`event.action`	2 detection rules	Elastic
`event.type`	1 detection rule	Elastic
`github.reasons.code`	1 detection rule	Elastic
`github.reasons.message`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000194,
  "actor_id": 9000103,
  "created_at": 1785235237501.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "rule_suite_id": 9000195,
  "actor_is_agent": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "after": "gggggggggggggggggggggggggggggggggggggggg",
  "action": "protected_branch.rejected_ref_update",
  "before": "gggggggggggggggggggggggggggggggggggggggg",
  "branch": "refs/heads/example-branch-8",
  "reasons": [
    {
      "code": "branch_deletion",
      "message": "Cannot delete this branch"
    }
  ],
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000196,
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "overridden_codes": []
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`github.category` (elastic rule field)	eq	`protected_branch`	3 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Several Failed Protected Branch Force Pushes by User source medium: Detects a high number of failed force push attempts to protected branches by a single user within a short time frame. Adversaries may attempt multiple force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.T1020, T1485, T1565, T1565.001, T1567, T1567.001
GitHub Actions Workflow Modification Blocked source medium: Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.T1059, T1195, T1195.001, T1195.002, T1546
GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_admin_enforced

#

Category: protected-branch

Description

Branch protection was enforced for repository administrators.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000187,
  "actor_id": 9000188,
  "created_at": 1784569461890.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "admin_enforced": false,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_admin_enforced",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000197,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_allow_deletions_enforcement_level

#

Category: protected-branch

Description

Branch deletion was enabled or disabled for a protected branch.

Documented on GitHub's organization audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000040,
  "repo_id": 9000198,
  "actor_id": 9000199,
  "created_at": 1781291183697.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "actor_is_agent": false,
  "allow_deletions_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_allow_deletions_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000200,
  "user_agent": "probot/14.2.4 example.invalid/7.0.6 example.invalid/20.20.2 (linux; x64)",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNg==",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "programmatic_access_type": "GitHub App server-to-server token"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_allow_force_pushes_enforcement_level

#

Category: protected-branch

Description

Force pushes were enabled or disabled for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000040,
  "repo_id": 9000198,
  "actor_id": 9000199,
  "created_at": 1781291183694.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "actor_is_agent": false,
  "allow_force_pushes_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_allow_force_pushes_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000200,
  "user_agent": "probot/14.2.4 example.invalid/7.0.6 example.invalid/20.20.2 (linux; x64)",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNg==",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "programmatic_access_type": "GitHub App server-to-server token"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_ignore_approvals_from_contributors

#

Category: protected-branch

Description

Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

protected_branch.update_linear_history_requirement_enforcement_level

#

Category: protected-branch

Description

Required linear commit history was enabled or disabled for a branch.

Documented on GitHub's organization audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000040,
  "repo_id": 9000198,
  "actor_id": 9000199,
  "created_at": 1781291183662.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "actor_is_agent": false,
  "linear_history_requirement_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_linear_history_requirement_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000200,
  "user_agent": "probot/14.2.4 example.invalid/7.0.6 example.invalid/20.20.2 (linux; x64)",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNg==",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "programmatic_access_type": "GitHub App server-to-server token"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_lock_allows_fetch_and_merge

#

Category: protected-branch

Description

Fork syncing was enabled or disabled for a read-only branch

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "@timestamp": 1783955175717,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDk=",
  "action": "protected_branch.update_lock_allows_fetch_and_merge",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955175717,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "lock_allows_fetch_and_merge": true,
  "name": "main",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000005,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0BAAD:F2C8EB5:6A54FEE7",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

protected_branch.update_lock_branch_enforcement_level

#

Category: protected-branch

Description

The enforcement of a branch lock was updated.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000201,
  "actor_id": 9000202,
  "created_at": 1784151432220.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "lock_branch_enforcement_level": 1.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_lock_branch_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000203,
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "enforcement_level": "non-admins",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_merge_queue_enforcement_level

#

Category: protected-branch

Description

Enforcement of the merge queue was modified for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000204,
  "actor_id": 9000205,
  "created_at": 1784752546256.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "merge_queue_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_merge_queue_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000206,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_name

#

Category: protected-branch

Description

A branch name pattern was updated for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

protected_branch.update_pull_request_reviews_enforcement_level

#

Category: protected-branch

Description

Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000187,
  "actor_id": 9000188,
  "created_at": 1784569634428.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "pull_request_reviews_enforcement_level": 0.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_pull_request_reviews_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000189,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_require_code_owner_review

#

Category: protected-branch

Description

Enforcement of required code owner review was updated for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000187,
  "actor_id": 9000188,
  "created_at": 1784569669568.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "require_code_owner_review": true,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_require_code_owner_review",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000207,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_require_last_push_approval

#

Category: protected-branch

Description

Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000208,
  "actor_id": 9000209,
  "created_at": 1782825732817.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "require_last_push_approval": true,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_require_last_push_approval",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000210,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_required_approving_review_count

#

Category: protected-branch

Description

Enforcement of the required number of approvals before merging was updated on a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "@timestamp": 1783955175663,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMTY=",
  "action": "protected_branch.update_required_approving_review_count",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783955175663,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "name": "main",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000005,
  "request_access_security_header": null,
  "request_id": "94CE:3FE560:EE0BAAD:F2C8EB5:6A54FEE7",
  "required_approving_review_count": 1,
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

protected_branch.update_required_status_checks_enforcement_level

#

Category: protected-branch

Description

Enforcement of required status checks was updated for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000211,
  "actor_id": 9000185,
  "created_at": 1782849423242.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "required_status_checks_enforcement_level": 1.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_required_status_checks_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000212,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_signature_requirement_enforcement_level

#

Category: protected-branch

Description

Enforcement of required commit signing was updated for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000181,
  "actor_id": 9000182,
  "created_at": 1781093004314.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": true,
  "actor_is_agent": false,
  "signature_requirement_enforcement_level": 2.0,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_signature_requirement_enforcement_level",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000213,
  "user_agent": "example.invalid/7.0.6 example.invalid/24",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAxNQ==",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "programmatic_access_type": "GitHub App server-to-server token"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

protected_branch.update_strict_required_status_checks_policy

#

Category: protected-branch

Description

Enforcement of required status checks was updated for a branch.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.type`	1 detection rule	Elastic
`github.category`	1 detection rule	Elastic

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000214,
  "actor_id": 9000215,
  "created_at": 1784573316295.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "strict_required_status_checks_policy": false,
  "org": "example-org",
  "name": "main",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "protected_branch.update_strict_required_status_checks_policy",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000216,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GitHub Protected Branch Settings Changed source medium category-level: This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.T1562, T1562.001↳ also matches protected_branch.authorized_users_teams, protected_branch.branch_allowances, protected_branch.create, protected_branch.destroy, protected_branch.dismiss_stale_reviews, protected_branch.dismissal_restricted_users_teams, and 17 more

References #

Humpty from IRCC

Protected Branch

protected_branch.authorized_users_teams

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

protected_branch.branch_allowances

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

protected_branch.create

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

protected_branch.destroy

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Panther #

References #

protected_branch.dismiss_stale_reviews

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

protected_branch.dismissal_restricted_users_teams

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

protected_branch.policy_override

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Panther #

References #

protected_branch.rejected_ref_update

Description

Detection Fields #

Example Audit Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

protected_branch.update_admin_enforced

Description

Detection Fields #

Example Audit Log Entry #

Related events #

Detection Rules #