LoFP LoFP / planned policy change to allow inner-source forks. confirm change tickets and that the setting is reverted if it was a test.

Techniques

Sample rules

GitHub Private Repository Forking Enabled

Description

Detects enabling of private repository forking on a GitHub organization. Allowing forks of private repositories lets code leave the organization into personal forks, which is a common collection path after an org-owner compromise.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "private_repository_forking.enable"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.visibility