GitHub Audit Log Streaming Configuration Modified or Deleted

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when a GitHub Enterprise audit log streaming destination is updated or deleted. Adversaries who gain enterprise
 11admin access may change the stream sink or destroy it to stop security telemetry from reaching the SIEM, or to redirect
 12audit events to attacker-controlled storage.
 13"""
 14false_positives = [
 15    """
 16    Planned stream rotation, sink migration, or pausing a misconfigured destination by an enterprise owner. Confirm the
 17    actor, change ticket, and that the production SIEM sink remains enabled.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "GitHub Audit Log Streaming Configuration Modified or Deleted"
 24note = """## Triage and analysis
 25
 26### Investigating GitHub Audit Log Streaming Configuration Modified or Deleted
 27
 28Enterprise audit log streaming is the durable copy of GitHub audit events. Updating or deleting a stream can blind detection coverage or send logs to an untrusted bucket.
 29
 30### Possible investigation steps
 31
 32- Identify `user.name`, `github.programmatic_access_type`, `github.hashed_token`, and `github.actor_ip`.
 33- Confirm whether `event.action` is `audit_log_streaming.update` or `audit_log_streaming.destroy` and inspect `github.audit_log_stream_id` / `github.audit_log_stream_sink`.
 34- Verify in GitHub Enterprise settings that the production SIEM destination is still enabled and pointing at the expected sink.
 35- Correlate nearby enterprise-admin actions (IP allow list, SSO, owner changes) from the same actor or token.
 36
 37### False positive analysis
 38
 39- Authorized sink rotation or OIDC role replacement.
 40- Deleting a throwaway/test stream while the production stream stays enabled.
 41
 42### Response and remediation
 43
 44- If unauthorized, restore the production stream immediately and rotate the actor's credentials.
 45- Review other enterprise settings changed in the same window.
 46- Treat a destroy of the SIEM-bound stream as a detection outage and backfill from GitHub's retained audit log if needed.
 47"""
 48references = [
 49    "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise",
 50]
 51risk_score = 73
 52rule_id = "f419b071-4568-4559-a81f-109075160537"
 53severity = "high"
 54tags = [
 55    "Domain: Cloud",
 56    "Domain: SaaS",
 57    "Platform: GitHub",
 58    "Use Case: Threat Detection",
 59    "Tactic: Defense Evasion",
 60    "Data Source: Github",
 61    "Data Source: GitHub Audit Logs",
 62    "Rule Type: ESQL",
 63    "Resources: Investigation Guide",
 64]
 65timestamp_override = "event.ingested"
 66type = "esql"
 67
 68query = '''
 69from logs-github.audit-* metadata _id, _index, _version
 70| where
 71  event.module == "github" and data_stream.dataset == "github.audit"
 72    and event.action in ("audit_log_streaming.update", "audit_log_streaming.destroy")
 73| keep
 74    _id,
 75    _index,
 76    _version,
 77    @timestamp,
 78    event.action,
 79    user.name,
 80    github.org,
 81    github.repo,
 82    github.actor_ip,
 83    github.hashed_token,
 84    github.programmatic_access_type,
 85    github.user_agent,
 86    github.business,
 87    github.audit_log_stream_id,
 88    github.audit_log_stream_sink,
 89    github.audit_log_stream_enabled
 90'''
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1562"
 97name = "Impair Defenses"
 98reference = "https://attack.mitre.org/techniques/T1562/"
 99[[rule.threat.technique.subtechnique]]
100id = "T1562.008"
101name = "Disable or Modify Cloud Logs"
102reference = "https://attack.mitre.org/techniques/T1562/008/"
103
104
105
106[rule.threat.tactic]
107id = "TA0005"
108name = "Defense Evasion"
109reference = "https://attack.mitre.org/tactics/TA0005/"
110
111[rule.investigation_fields]
112field_names = [
113    "@timestamp",
114    "event.action",
115    "user.name",
116    "github.org",
117    "github.repo",
118    "github.actor_ip",
119    "github.hashed_token",
120    "github.programmatic_access_type",
121    "github.user_agent",
122    "github.business",
123    "github.audit_log_stream_id",
124    "github.audit_log_stream_sink",
125    "github.audit_log_stream_enabled",
126]