detection.wiki

Repository Ruleset

actionDescriptionSampleRule
repository_ruleset.createA repository ruleset was created.YY
repository_ruleset.destroyA repository ruleset was deleted.YY
repository_ruleset.updateA repository ruleset was edited.YY

repository_ruleset.create

#
Category
repository-ruleset

Description

A repository ruleset was created.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action1 detection rulePanther

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000348,
  "actor_id": 9000084,
  "created_at": 1785270361580.0,
  "ruleset_id": 9000350,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.create",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000351,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "main",
  "ruleset_rules": [
    {
      "id": 100023,
      "parameters": {},
      "type": "deletion"
    },
    {
      "id": 100024,
      "parameters": {},
      "type": "non_fast_forward"
    },
    {
      "id": 100025,
      "parameters": {
        "allowed_merge_methods": [
          "squash",
          "rebase",
          "merge"
        ],
        "authorized_dismissal_actors_only": false,
        "dismiss_stale_reviews_on_push": false,
        "dismissal_restriction": {
          "allowed_actors": [],
          "enabled": false
        },
        "ignore_approvals_from_contributors": false,
        "require_code_owner_review": true,
        "require_last_push_approval": false,
        "required_approving_review_count": 1,
        "required_review_thread_resolution": false,
        "required_reviewers": []
      },
      "type": "pull_request"
    }
  ],
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "create",
  "ruleset_conditions": [
    {
      "id": 100026,
      "parameters": {
        "exclude": [],
        "include": [
          "~DEFAULT_BRANCH"
        ]
      },
      "target": "ref_name"
    }
  ],
  "ruleset_enforcement": "disabled",
  "ruleset_source_type": "Repository",
  "ruleset_bypass_actors": [],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

repository_ruleset.destroy

#
Category
repository-ruleset

Description

A repository ruleset was deleted.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action2 detection rulesPanther, Splunk
vendor_action1 detection ruleSplunk

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000352,
  "actor_id": 9000047,
  "created_at": 1784552870922.0,
  "ruleset_id": 9000353,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.destroy",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000354,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "example-label-146",
  "ruleset_rules": [
    {
      "id": 100005,
      "parameters": {},
      "type": "deletion"
    },
    {
      "id": 100006,
      "parameters": {},
      "type": "non_fast_forward"
    },
    {
      "id": 100007,
      "parameters": {
        "update_allows_fetch_and_merge": false
      },
      "type": "update"
    },
    {
      "id": 100008,
      "parameters": {},
      "type": "creation"
    }
  ],
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "remove",
  "ruleset_conditions": [
    {
      "id": 100009,
      "parameters": {
        "exclude": [],
        "include": [
          "~ALL"
        ]
      },
      "target": "ref_name"
    }
  ],
  "ruleset_enforcement": "enabled",
  "ruleset_source_type": "Repository",
  "ruleset_bypass_actors": [
    {
      "actor_id": 9000355,
      "actor_type": "Team",
      "bypass_mode": "always",
      "id": 100010
    },
    {
      "actor_id": 9000356,
      "actor_type": "Team",
      "bypass_mode": "always",
      "id": 100011
    }
  ],
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • GitHub Enterprise Delete Branch Ruleset source: The following analytic detects when branch rules are deleted in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information, and associated…T1195, T1685
  • GitHub Organizations Delete Branch Ruleset source: The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and…T1195, T1685

Panther #

repository_ruleset.update

#
Category
repository-ruleset

Description

A repository ruleset was edited.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action1 detection rulePanther

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000348,
  "actor_id": 9000084,
  "created_at": 1785270369240.0,
  "ruleset_id": 9000350,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "repository_ruleset.update",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000357,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "ruleset_name": "main",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "ruleset_enforcement": "enabled",
  "ruleset_source_type": "Repository",
  "ruleset_old_enforcement": "disabled",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

References #