« First Occurrence of Personal Access Token (PAT) Use For a GitHub User First Occurrence of STS GetFederationToken Request by User »
Elastic Docs ›Elastic Security Solution [8.15] ›Detections and alerts ›Prebuilt rule reference

First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)

edit

First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)

edit

Detects a new private repo interaction for a GitHub PAT not seen in the last 14 days.

Rule type: new_terms

Rule indices:

  • logs-github.audit-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Cloud
  • Use Case: Threat Detection
  • Use Case: UEBA
  • Tactic: Execution
  • Rule Type: BBR
  • Data Source: Github

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
event.dataset:"github.audit" and event.category:"configuration" and
github.repo:* and github.hashed_token:* and
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token") and
github.repository_public:false

Framework: MITRE ATT&CKTM

« First Occurrence of Personal Access Token (PAT) Use For a GitHub User First Occurrence of STS GetFederationToken Request by User »