GitHubAuditData
| where Action == "pull_request.merge"
| project Actor, Action
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
- columnName: Actor
identifier: FullName
- columnName: AccountName
identifier: Name
- columnName: AccountUPNSuffix
identifier: UPNSuffix
entityType: Account
triggerThreshold: 0
description: |
'Detect activities when a pull request was merged. This query runs every day and its severity is Medium.'
requiredDataConnectors: []
triggerOperator: gt
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/(Preview) GitHub - pull request was merged.yaml
id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c6
queryFrequency: 1d
query: |
GitHubAuditData
| where Action == "pull_request.merge"
| project Actor, Action
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
severity: Medium
status: Available
queryPeriod: 7d
name: (Preview) GitHub - pull request was merged
tactics:
- InitialAccess
kind: Scheduled
