Detects when GitHub Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level by analyzing GitHub Audit Logs. Disabling Dependabot reduces automated visibility into vulnerable or malicious dependencies and may bypass security coverage across multiple repos. The rule targets audit events in the GitHub audit data stream where actions disable vulnerability alerts or security updates (e.g., repository_vulnerability_alerts.disable, repository_security_updates.disable, dependabot_alerts.disable, dependabot_alerts_new_repos.disable, dependabot_security_updates.disable, dependabot_security_updates_new_repos.disable, business_dependabot_alerts.disable, business_dependabot_alerts_new_repos.disable). It captures context such as @timestamp, event.action, user.name, github.org, github.repo, actor IP, whether a token was hashed, programmatic_access_type, and user_agent to aid attribution and response. MITRE ATT&CK mapping: T1562.001 Disable or Modify Tools under Defense Evasion (TA0005). Investigation fields are provided to assist rapid triage. The rule includes guidance on potential investigation steps, false positives, and remediation actions, including re-enabling alerts, auditing dependencies and workflow files, and rotating credentials if the actor is not a known admin. References include GitHub’s dependabot guidance and the rule’s own investigation notes and remediation recommendations.