LoFP LoFP / cost-control or license changes that turn ghas off for archival orgs. confirm billing intent and that production orgs remain covered.

Techniques

Sample rules

GitHub Advanced Security Disabled

Description

Detects GitHub Advanced Security being disabled for an enterprise, for all or new repositories in an organization, for existing or new user-namespace repositories, or for selected members via enterprise policy. Disabling GHAS removes secret scanning, code scanning, and related controls.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "business_advanced_security.disabled",
      "business_advanced_security.disabled_for_new_repos",
      "business_advanced_security.disabled_for_new_user_namespace_repos",
      "business_advanced_security.user_namespace_repos_disabled",
      "org.advanced_security_disabled_on_all_repos",
      "org.advanced_security_disabled_for_new_repos",
      "org.advanced_security_policy_selected_member_disabled"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.business