
Summary
The rule 'GitHub Repository Created' is designed to detect the creation of a new repository within the GitHub platform. It monitors logs of type 'GitHub.Audit' to identify actions taken by users. When a repository is created, the log will show an entry with the action 'repo.create' performed by a user (actor) along with the repository details. The rule specifically checks for the presence of this action and the associated metadata such as the organization and repository name. The severity level is set to 'Info', indicating that this detection is primarily for informational purposes rather than indicating a security threat. It is important to note that other actions, such as 'repo.archived', will not trigger this rule, ensuring that only relevant events are captured. This detection can help organizations keep track of changes to their repository structure and maintain visibility over their GitHub activities.
Categories
- Web
- Cloud
- Application
- Identity Management
Data Sources
- User Account
- Application Log
- Web Credential
Created: 2022-09-02