Team Group Mapping
| action | Description | Sample | Rule |
|---|---|---|---|
| team_ | Y | Y | |
| team_ | Y | Y | |
| team_ | Y | Y |
team_group_mapping.create
#Documented on GitHub's organization audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784737287259.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.create",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000421,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.destroy, team_group_mapping.update
team_group_mapping.destroy
#Documented on GitHub's organization audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784738620872.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.destroy",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000422,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.create, team_group_mapping.update
team_group_mapping.update
#Documented on GitHub's organization audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000155,
"created_at": 1784738620902.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-15",
"actor": "user",
"action": "team_group_mapping.update",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000422,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team_group_mapping.create, team_group_mapping.destroy