Detects when GitHub Advanced Security (GHAS) is disabled across an enterprise, including all repos in an organization, new repos, existing or new user-namespace repos, or via an enterprise policy affecting selected members. The rule correlates specific GitHub Audit Log events (business_advanced_security.* and org.advanced_security_*) that indicate disabling actions, e.g., business_advanced_security.disabled, business_advanced_security.disabled_for_new_repos, business_advanced_security.disabled_for_new_user_namespace_repos, org.advanced_security_disabled_on_all_repos, org.advanced_security_disabled_for_new_repos, org.advanced_security_policy_selected_member_disabled. It uses the github.audit data stream (logs-github.audit-*), and surfaces fields such as @timestamp, event.action, user.name, github.org, github.repo, github.actor_ip, github.hashed_token, github.programmatic_access_type, github.user_agent, and github.business. The rule maps to MITRE ATT&CK Tactics/Techniques: Defense Evasion (TA0005) with T1562 (Impair Defenses) and subtechnique T1562.001 (Disable or Modify Tools). Triage guidance includes validating the user/org context, and verifying secret scanning, Dependabot, and code scanning status on critical repos. False positives may include license changes or billing-related downgrades; remediation involves re-enabling GHAS and reviewing commits that occurred while scanning was disabled. References: GitHub Advanced Security documentation. The rule aids incident response by providing a focused audit trail of GHAS deactivation actions and relevant metadata for investigation and containment.