GitHub Dependabot Alerts or Security Updates Disabled

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in
 11GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they
 12introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at
 13once.
 14"""
 15false_positives = [
 16    """
 17    Repository admins disabling Dependabot on archival, template, or non-code repos. Confirm the change was intended and
 18    that production application repos remain covered.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "GitHub Dependabot Alerts or Security Updates Disabled"
 25note = """## Triage and analysis
 26
 27### Investigating GitHub Dependabot Alerts or Security Updates Disabled
 28
 29Disabling Dependabot removes automated visibility into vulnerable and malicious packages. This can precede a supply-chain commit or lockfile change. Repository-level actions affect a single repo, while `dependabot_*` (organization) and `business_dependabot_*` (enterprise) actions remove coverage across many repositories at once.
 30
 31### Possible investigation steps
 32
 33- Identify `user.name`, `github.org`, `github.repo`, `event.action`, and `github.programmatic_access_type`, and note whether the action is repository-, organization-, or enterprise-scoped.
 34- Review commits and dependency manifest changes around the disable timestamp.
 35- Check whether Secret Scanning, code scanning, or the org security configuration were also changed.
 36- Re-enable Dependabot unless there is an approved exception.
 37
 38### False positive analysis
 39
 40- Bulk disable on forks, mirrors, or documentation-only repositories.
 41- Org-policy automation that detaches a security configuration.
 42
 43### Response and remediation
 44
 45- Re-enable Dependabot alerts (and security updates if required by policy).
 46- Audit recently added dependencies and workflow files.
 47- Rotate credentials if the actor is not a known admin.
 48"""
 49references = ["https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide"]
 50risk_score = 47
 51rule_id = "9164d803-bc5f-4197-a242-a3008707336c"
 52severity = "medium"
 53tags = [
 54    "Domain: Cloud",
 55    "Domain: SaaS",
 56    "Platform: GitHub",
 57    "Use Case: Threat Detection",
 58    "Tactic: Defense Evasion",
 59    "Data Source: Github",
 60    "Data Source: GitHub Audit Logs",
 61    "Rule Type: ESQL",
 62    "Resources: Investigation Guide",
 63]
 64timestamp_override = "event.ingested"
 65type = "esql"
 66
 67query = '''
 68from logs-github.audit-* metadata _id, _index, _version
 69| where
 70  event.module == "github" and data_stream.dataset == "github.audit"
 71    and event.action in (
 72      "repository_vulnerability_alerts.disable",
 73      "repository_security_updates.disable",
 74      "dependabot_alerts.disable",
 75      "dependabot_alerts_new_repos.disable",
 76      "dependabot_security_updates.disable",
 77      "dependabot_security_updates_new_repos.disable",
 78      "business_dependabot_alerts.disable",
 79      "business_dependabot_alerts_new_repos.disable"
 80    )
 81| keep
 82    _id,
 83    _index,
 84    _version,
 85    @timestamp,
 86    event.action,
 87    user.name,
 88    github.org,
 89    github.repo,
 90    github.actor_ip,
 91    github.hashed_token,
 92    github.programmatic_access_type,
 93    github.user_agent
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1562"
101name = "Impair Defenses"
102reference = "https://attack.mitre.org/techniques/T1562/"
103[[rule.threat.technique.subtechnique]]
104id = "T1562.001"
105name = "Disable or Modify Tools"
106reference = "https://attack.mitre.org/techniques/T1562/001/"
107
108
109
110[rule.threat.tactic]
111id = "TA0005"
112name = "Defense Evasion"
113reference = "https://attack.mitre.org/tactics/TA0005/"
114
115[rule.investigation_fields]
116field_names = [
117    "@timestamp",
118    "event.action",
119    "user.name",
120    "github.org",
121    "github.repo",
122    "github.actor_ip",
123    "github.hashed_token",
124    "github.programmatic_access_type",
125    "github.user_agent",
126]