GitHub - pull request was created

Back


Id	0b85a077-8ba5-4cb5-90f7-1e882afe10c7
Rulename	GitHub - pull request was created
Description	Detect activities when a pull request was created. This query runs every day and its severity is Medium.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Kind	Scheduled
Query frequency	1d
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - pull request was created.yaml
Version	1.0.1
Arm template	0b85a077-8ba5-4cb5-90f7-1e882afe10c7.json

KQL

GitHubAuditData 
| where Action == "pull_request.create"
| project Actor, Action
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

YAML

name: GitHub - pull request was created
query: |
  GitHubAuditData 
  | where Action == "pull_request.create"
  | project Actor, Action
  | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Actor
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
queryPeriod: 7d
version: 1.0.1
tactics:
- InitialAccess
triggerOperator: gt
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - pull request was created.yaml
relevantTechniques:
- T1078
id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c7
severity: Medium
requiredDataConnectors: []
status: Available
description: |
    'Detect activities when a pull request was created. This query runs every day and its severity is Medium.'
queryFrequency: 1d

ARM