LoFP LoFP / planned stream rotation, sink migration, or pausing a misconfigured destination by an enterprise owner. confirm the actor, change ticket, and that the production siem sink remains enabled.

Techniques

Sample rules

GitHub Audit Log Streaming Configuration Modified or Deleted

Description

Detects when a GitHub Enterprise audit log streaming destination is updated or deleted. Adversaries who gain enterprise admin access may change the stream sink or destroy it to stop security telemetry from reaching the SIEM, or to redirect audit events to attacker-controlled storage.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in ("audit_log_streaming.update", "audit_log_streaming.destroy")
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.business,
    github.audit_log_stream_id,
    github.audit_log_stream_sink,
    github.audit_log_stream_enabled