LoFP LoFP / repository admins disabling dependabot on archival, template, or non-code repos. confirm the change was intended and that production application repos remain covered.

Techniques

Sample rules

GitHub Dependabot Alerts or Security Updates Disabled

Description

Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at once.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "repository_vulnerability_alerts.disable",
      "repository_security_updates.disable",
      "dependabot_alerts.disable",
      "dependabot_alerts_new_repos.disable",
      "dependabot_security_updates.disable",
      "dependabot_security_updates_new_repos.disable",
      "business_dependabot_alerts.disable",
      "business_dependabot_alerts_new_repos.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent