GitHub Advanced Security Disabled

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects GitHub Advanced Security being disabled for an enterprise, for all or new repositories in an organization, for
 11existing or new user-namespace repositories, or for selected members via enterprise policy. Disabling GHAS removes
 12secret scanning, code scanning, and related controls.
 13"""
 14false_positives = [
 15    """
 16    Cost-control or license changes that turn GHAS off for archival orgs. Confirm billing intent and that production
 17    orgs remain covered.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "GitHub Advanced Security Disabled"
 24note = """## Triage and analysis
 25
 26### Investigating GitHub Advanced Security Disabled
 27
 28Enterprise `business_advanced_security.*` disable actions (for the business, new repositories, and existing or new user-namespace repositories) and org-level `org.advanced_security_*` disable actions (all repos, new repos, and selected-member policy) strip scanning coverage. This is separate from a single-repo `repository_secret_scanning.disable`.
 29
 30### Possible investigation steps
 31
 32- Identify `user.name`, `event.action`, and `github.org`.
 33- Check secret scanning, Dependabot, and code scanning on critical repositories.
 34
 35### False positive analysis
 36
 37- License downsizing with a finance ticket.
 38
 39### Response and remediation
 40
 41- Re-enable Advanced Security. Review commits made while scanning was off.
 42"""
 43references = ["https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security"]
 44risk_score = 47
 45rule_id = "87faf5bf-6e86-4de4-90f0-1da1e0d646f3"
 46severity = "medium"
 47tags = [
 48    "Domain: Cloud",
 49    "Domain: SaaS",
 50    "Platform: GitHub",
 51    "Use Case: Threat Detection",
 52    "Tactic: Defense Evasion",
 53    "Data Source: Github",
 54    "Data Source: GitHub Audit Logs",
 55    "Rule Type: ESQL",
 56    "Resources: Investigation Guide",
 57]
 58timestamp_override = "event.ingested"
 59type = "esql"
 60
 61query = '''
 62from logs-github.audit-* metadata _id, _index, _version
 63| where
 64  event.module == "github" and data_stream.dataset == "github.audit"
 65    and event.action in (
 66      "business_advanced_security.disabled",
 67      "business_advanced_security.disabled_for_new_repos",
 68      "business_advanced_security.disabled_for_new_user_namespace_repos",
 69      "business_advanced_security.user_namespace_repos_disabled",
 70      "org.advanced_security_disabled_on_all_repos",
 71      "org.advanced_security_disabled_for_new_repos",
 72      "org.advanced_security_policy_selected_member_disabled"
 73    )
 74| keep
 75    _id,
 76    _index,
 77    _version,
 78    @timestamp,
 79    event.action,
 80    user.name,
 81    github.org,
 82    github.repo,
 83    github.actor_ip,
 84    github.hashed_token,
 85    github.programmatic_access_type,
 86    github.user_agent,
 87    github.business
 88'''
 89
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1562"
 95name = "Impair Defenses"
 96reference = "https://attack.mitre.org/techniques/T1562/"
 97[[rule.threat.technique.subtechnique]]
 98id = "T1562.001"
 99name = "Disable or Modify Tools"
100reference = "https://attack.mitre.org/techniques/T1562/001/"
101
102
103
104[rule.threat.tactic]
105id = "TA0005"
106name = "Defense Evasion"
107reference = "https://attack.mitre.org/tactics/TA0005/"
108
109[rule.investigation_fields]
110field_names = [
111    "@timestamp",
112    "event.action",
113    "user.name",
114    "github.org",
115    "github.repo",
116    "github.actor_ip",
117    "github.hashed_token",
118    "github.programmatic_access_type",
119    "github.user_agent",
120    "github.business",
121]