GitHubAuditData
| where Action == "repo.destroy"
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
triggerOperator: gt
queryFrequency: 1d
requiredDataConnectors: []
relevantTechniques:
- T1078
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Actor
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: AccountUPNSuffix
query: |
GitHubAuditData
| where Action == "repo.destroy"
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - Repository was destroyed.yaml
queryPeriod: 7d
name: GitHub - Repository was destroyed
status: Available
kind: Scheduled
description: |
'Detect activities when a repository was destroyed. This query runs every day and its severity is Medium.'
id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c3
version: 1.0.1
tactics:
- InitialAccess
severity: Medium
