
Summary
The rule 'GitHub.Repo.HookModified' is designed to monitor modifications to webhooks within GitHub repositories. This rule has been marked as deprecated, indicating that it is no longer recommended for use, with an alternative rule 'GitHub.Webhook.Modified' suggested for continued monitoring of webhook-related events. The main function of this rule is to detect actions related to the creation and deletion of webhooks, which can be crucial for ensuring the security and integrity of integrations with external systems. It primarily focuses on tracking two specific events: the creation of a new webhook and the deletion of an existing webhook. Each event type generates specific logs that are reviewed for audit purposes. Overall, given its deprecated status, users are advised to transition to the newer monitoring approach while still keeping an eye on the functionalities provided by this rule until fully migrated.
Categories
- Cloud
- Application
- Identity Management
Data Sources
- Web Credential
- Application Log
ATT&CK Techniques
- T1020
Created: 2022-09-02