Detects when a GitHub Enterprise audit log streaming destination is updated or deleted. Adversaries with enterprise admin access may modify the production sink to stop security telemetry from reaching the SIEM or redirect logs to attacker-controlled storage. The rule triggers on GitHub audit log events with event.action values of audit_log_streaming.update or audit_log_streaming.destroy, and surfaces fields such as user.name, github.actor_ip, github.hashed_token, github.programmatic_access_type, and github.audit_log_stream_sink/id. This enables investigators to verify the production SIEM destination, correlate with related admin actions, and respond by restoring the sink and rotating credentials. It maps to MITRE ATT&CK T1562.008 (Disable or Modify Cloud Logs) under Defense Evasion.