Team
| action | Description | Sample | Rule |
|---|---|---|---|
| team. | A member of an organization was added to a team. | Y | Y |
| team. | A team was given access and permissions to a repository. | Y | Y |
| team. | A team was added to an organization. | N | Y |
| team. | A child team was created or a child team's parent was changed. | Y | Y |
| team. | A team's privacy level was changed. | Y | Y |
| team. | A new team is created. | Y | Y |
| team. | A user was demoted from a team maintainer to a team member. | N | Y |
| team. | A team was deleted. | Y | Y |
| team. | A team is approaching its members limit. | N | Y |
| team. | A team has reached its organization assignments limit. | N | Y |
| team. | A team is approaching its organization assignments limit. | N | Y |
| team. | A user was promoted from a team member to a team maintainer. | Y | Y |
| team. | A team was removed from an organization. | N | Y |
| team. | An organization member was removed from a team. | Y | Y |
| team. | A repository was removed from a team's control. | Y | Y |
| team. | A team's name was changed. | Y | Y |
| team. | A team's permission to a repository was changed. | Y | Y |
team.add_member
#Description
A member of an organization was added to a team.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000407,
"actor_id": 9000155,
"created_at": 1782482832874.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.add_member",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000408,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.add_repository
#Description
A team was given access and permissions to a repository.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action2 detection rules Panther p_event_time1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"repo_id": 9000348,
"actor_id": 9000084,
"created_at": 1785258901216.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-org-1/example-team-1",
"actor": "user",
"action": "team.add_repository",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"permission": "admin",
"request_id": 9000409,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.add_to_organization
#Description
A team was added to an organization.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.change_parent_team, team.change_privacy, team.create, team.demote_maintainer, and 10 more
team.change_parent_team
#Description
A child team was created or a child team's parent was changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000060,
"created_at": 1781806971059.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-2",
"actor": "user",
"action": "team.change_parent_team",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000410,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_privacy, team.create, team.demote_maintainer, and 10 more References #
team.change_privacy
#Description
A team's privacy level was changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000060,
"created_at": 1782139068321.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-13",
"actor": "user",
"action": "team.change_privacy",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000411,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.create, team.demote_maintainer, and 10 more References #
team.create
#Description
A new team is created.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"user_id": 9000060,
"actor_id": 9000060,
"created_at": 1782138960825.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-business-1/example-team-13",
"user": "user",
"actor": "user",
"action": "team.create",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000412,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.demote_maintainer, and 10 more References #
team.demote_maintainer
#Description
A user was demoted from a team maintainer to a team member.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.destroy
#Description
A team was deleted.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000047,
"created_at": 1781705068568.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-6",
"actor": "user",
"action": "team.destroy",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000413,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.members_limit_warning
#Description
A team is approaching its members limit.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.organization_assignments_limit_reached
#Description
A team has reached its organization assignments limit.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.organization_assignments_limit_warning
#Description
A team is approaching its organization assignments limit.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.promote_maintainer
#Description
A user was promoted from a team member to a team maintainer.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000205,
"actor_id": 9000407,
"token_id": 9000414,
"created_at": 1782483411320.0,
"business_id": 9000005,
"actor_is_bot": false,
"oauth_application_id": 9000044,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.promote_maintainer",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000415,
"user_agent": "GitHub CLI 2.95.0",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAyNw==",
"token_scopes": "copilot,gist,read:org,repo,workflow",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"programmatic_access_type": "OAuth access token",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.remove_from_organization
#Description
A team was removed from an organization.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more
team.remove_member
#Description
An organization member was removed from a team.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000155,
"actor_id": 9000155,
"created_at": 1782482853034.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"team": "example-org-1/example-team-7",
"user": "user",
"actor": "user",
"action": "team.remove_member",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000416,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.remove_repository
#Description
A repository was removed from a team's control.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"repo_id": 9000046,
"actor_id": 9000047,
"created_at": 1784577550990.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-business-1/example-team-14",
"actor": "user",
"action": "team.remove_repository",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000049,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.rename
#Description
A team's name was changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000008,
"actor_id": 9000417,
"created_at": 1783518323920.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"name": "example-label-150",
"team": "example-business-1/example-team-9",
"actor": "user",
"action": "team.rename",
"actor_ip": "ip-redacted",
"business": "example-business",
"name_was": "CUI - Service Connectivity",
"team_type": "organization",
"request_id": 9000418,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #
team.update_repository_permission
#Description
A team's permission to a repository was changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Panther Example Audit Log Entry #
{
"org_id": 9000002,
"repo_id": 9000201,
"user_id": 9000419,
"actor_id": 9000419,
"created_at": 1785241188287.0,
"business_id": 9000005,
"public_repo": false,
"actor_is_bot": false,
"org": "example-org",
"repo": "user/example-repo",
"team": "example-org-1/example-team-4",
"user": "user",
"actor": "user",
"action": "team.update_repository_permission",
"actor_ip": "ip-redacted",
"business": "example-business",
"team_type": "organization",
"request_id": 9000420,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"old_permissions": {
"admin": false,
"maintain": false,
"pull": true,
"push": true,
"triage": true
},
"old_repo_base_role": "write",
"new_repo_permission": "admin",
"old_repo_permission": "Write + Security Alerts",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Detection Rules #
Panther #
T1195↳ also matches team.add_member, team.add_repository, team.add_to_organization, team.change_parent_team, team.change_privacy, team.create, and 10 more References #