Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when GitHub audit log streaming settings have been modified.

Strategy

This rule monitors GitHub audit logs streaming settings when altered. A modification in this setting could cause degradation in the security posture of an organization as audit logs would cease to flow into centralized storage.

Triage and response

1. Determine if the change taken by {{@github.actor}} is authorized.
2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.