LoFP / approved changes by the organization owner. please validate the 'actor' if authorized to make the changes.

Techniques

• t1195
• t1195.001

Sample rules

Outdated Dependency Or Vulnerability Alert Disabled

• source: sigma
• technicques:
  • t1195
  • t1195.001

Description

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Detection logic

condition: selection
selection:
  action:
  - dependabot_alerts_new_repos.disable
  - dependabot_alerts.disable
  - dependabot_security_updates_new_repos.disable
  - dependabot_security_updates.disable
  - repository_vulnerability_alerts.disable