GitHub personal access token (PAT) auto approve policy modified

This rule is part of a beta feature. To learn more, contact Support.

Goal

Detect when a GitHub personal access token is set to auto approve.

Strategy

This rule monitors GitHub audit logs for when a GitHub organization changes the auto approval policy on personal access tokens. Changes in personal access token (PAT) settings can be a sign of persistence from an actor that is generating PATs to maintain access to repositories.

Triage and response

  1. Determine if the change taken by {{@github.actor}} is authorized.
  2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.