GitHub audit log streaming endpoint was deleted


Detect when a GitHub audit log stream has been deleted.


This rule monitors GitHub audit logs for when an audit log stream is deleted. An attacker may remove an audit log stream to evade defenses set up by a security team.

Triage and response

  1. Determine if the change taken by {{}} is authorized.
  2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.