Detects changes to a GitHub organization's IP allow list by monitoring audit events for creation, updating, destruction of allow-list entries, or enabling/disabling enforcement across various scopes (including installed GitHub Apps, IdP web allow lists, and user-level enforcement). Attacker with org-owner access can add/modify their own address, then enable enforcement or weaken enforcement to lock out administrators. The rule queries the GitHub audit logs (logs-github.audit-*) for actions such as ip_allow_list_entry.create/update/destroy and ip_allow_list.enable/disable (including variants for apps and IdP web lists) and returns fields like timestamp, user.name, github.org, github.repo, actor IP, programmatic_access_type, user_agent, and entry name. It maps to MITRE ATT&CK techniques T1562.007 (Disable/Modify Cloud Firewall) and T1556 (Modify Authentication Process) under Defense Evasion and Persistence, respectively. The rule carries a risk score of 47 and a severity of medium. Investigators should verify the enforcement state against policy, correlate with unusual source IPs or git activity, and prioritize enforcement changes over individual entries to avoid lockouts. Remediation involves removing unauthorized entries, validating enforcement state, and rotating credentials if changes were unauthorized. False positives include routine onboarding changes or automated CMDB synchronization."