detection.wiki

Secret Scanning New Repos

actionDescriptionSampleRule
secret_scanning_new_repos.disableSecret scanning was disabled for all new repositories.YY
secret_scanning_new_repos.enableSecret scanning was enabled for all new repositories.YN

secret_scanning_new_repos.disable

#
Category
secret-scanning-new-repos

Description

Secret scanning was disabled for all new repositories.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action2 detection rulesPanther, Sigma

Example Audit Log Entry #

{
  "@timestamp": 1783957529242,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNTY=",
  "action": "secret_scanning_new_repos.disable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783957529242,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "request_access_security_header": null,
  "request_id": "EA04:7E563:F4C1341:F98D83A:6A550818",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

YARA-L #

Panther #

secret_scanning_new_repos.enable

#
Category
secret-scanning-new-repos

Description

Secret scanning was enabled for all new repositories.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783957526240,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNjQ=",
  "action": "secret_scanning_new_repos.enable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783957526240,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "request_access_security_header": null,
  "request_id": "EA04:7E563:F4C00F8:F98C5CD:6A550815",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}