GitHub Secret Scanning Alert for a Publicly Leaked Secret

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GitHub secret scanning creating an alert for a secret that it has determined is publicly leaked
 11("github.publicly_leaked == true"). Unlike a generic secret-scanning finding, a publicly leaked secret means GitHub
 12observed the credential exposed outside the repository's access boundary (for example in a public repository, gist, or
 13other public location), so it should be treated as a confirmed credential compromise requiring immediate rotation
 14rather than a low-signal scanner event. Gating on the public-leak flag also removes most of the noise from dummy
 15strings and test fixtures, which are typically confined to private repositories and are not flagged as publicly
 16leaked.
 17"""
 18false_positives = [
 19    """
 20    Example or dummy tokens that are themselves committed to a public repository can still be flagged as publicly
 21    leaked. Tune by repository, pattern name (`github.secret_type`), or known test org when such keys are expected.
 22    """,
 23]
 24from = "now-9m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "GitHub Secret Scanning Alert for a Publicly Leaked Secret"
 28note = """## Triage and analysis
 29
 30### Investigating GitHub Secret Scanning Alert for a Publicly Leaked Secret
 31
 32`secret_scanning_alert.create` with `github.publicly_leaked == true` means GitHub determined the matched secret is exposed in a public location, not just committed to the repository. Treat the credential as compromised and rotate it immediately.
 33
 34### Possible investigation steps
 35
 36- Identify the exposed credential type from `github.secret_type` / `github.secret_type_display_name` and the affected `github.repo` and `github.org`.
 37- Review `github.multi_repo`; if true, the same secret was detected across multiple repositories, widening the blast radius.
 38- Identify the committer via `user.name` (vs the `github` service actor) and corroborate with `github.actor_ip` and `github.user_agent`.
 39- Determine the source and scope of the public exposure and whether the secret grants access to production systems.
 40
 41### False positive analysis
 42
 43- Example or dummy keys intentionally published to a public repository can be flagged as publicly leaked. Scope these by repository or `github.secret_type`.
 44
 45### Response and remediation
 46
 47- Revoke and rotate the exposed credential immediately, then invalidate any sessions or tokens derived from it.
 48- Remove the secret from git history if required by policy and audit for any use of the credential prior to rotation.
 49"""
 50references = ["https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning"]
 51risk_score = 73
 52rule_id = "305f8b49-ac0a-4f08-82fe-560cd30d66fd"
 53severity = "high"
 54tags = [
 55    "Domain: Cloud",
 56    "Domain: SaaS",
 57    "Platform: GitHub",
 58    "Use Case: Threat Detection",
 59    "Tactic: Credential Access",
 60    "Data Source: GitHub Audit Logs",
 61    "Service: GitHub Code Scanning",
 62    "Rule Type: ESQL",
 63    "Resources: Investigation Guide",
 64]
 65timestamp_override = "event.ingested"
 66type = "esql"
 67
 68query = '''
 69from logs-github.audit-* metadata _id, _index, _version
 70| where
 71  event.module == "github" and data_stream.dataset == "github.audit"
 72    and event.action == "secret_scanning_alert.create"
 73    and github.publicly_leaked == true
 74| keep
 75    _id,
 76    _index,
 77    _version,
 78    @timestamp,
 79    event.action,
 80    user.name,
 81    github.org,
 82    github.repo,
 83    github.actor_ip,
 84    github.hashed_token,
 85    github.programmatic_access_type,
 86    github.user_agent,
 87    github.secret_type,
 88    github.secret_type_display_name,
 89    github.publicly_leaked,
 90    github.multi_repo
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1552"
 98name = "Unsecured Credentials"
 99reference = "https://attack.mitre.org/techniques/T1552/"
100[[rule.threat.technique.subtechnique]]
101id = "T1552.001"
102name = "Credentials In Files"
103reference = "https://attack.mitre.org/techniques/T1552/001/"
104
105
106
107[rule.threat.tactic]
108id = "TA0006"
109name = "Credential Access"
110reference = "https://attack.mitre.org/tactics/TA0006/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "event.action",
116    "user.name",
117    "github.org",
118    "github.repo",
119    "github.actor_ip",
120    "github.hashed_token",
121    "github.programmatic_access_type",
122    "github.user_agent",
123    "github.secret_type",
124    "github.secret_type_display_name",
125    "github.publicly_leaked",
126    "github.multi_repo",
127]