GitHub audit log streaming endpoint was deleted

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a GitHub audit log stream has been deleted.

Strategy

This rule monitors GitHub audit logs for when an audit log stream is deleted. An attacker may remove an audit log stream to evade defenses set up by a security team.

Triage and response

  1. Determine if the change taken by {{@github.actor}} is authorized.
  2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.